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afpubs.hq.af.mil  under  electronic  publications.  Air  Eorce  Directory  (AEDIR)  33-303,  Compendium  of 
Communications  and  Information  Terminology,  explains  other  terms.  Direct  technical  questions  on  the 
contents  of  this  manual  to  Headquarters  Air  Eorce  Communications  Agency  (HQ  AECA/TCBA-CTTA), 
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turer,  commercial  product,  commodity,  or  service  in  this  publication  does  not  imply  endorsement  by  the 
Air  Eorce.  See  Attachment  1  for  a  glossary  of  references  and  supporting  information.  Maintain  and  dis¬ 
pose  of  records  created  as  a  result  of  prescribed  processes  according  to  AEMAN  37-139,  Records  Dispo¬ 
sition  Schedule  (will  become  AEMAN  33-322,  Volume  4).  The  Paperwork  Reduction  Act  of  1980  (Public 
Law  [P.L.]  96-511)  and  AEI  33-360,  Volume  2,  Forms  Management  Program  affect  this  publication. 
NOTE:  This  AEMAN  replaces  Air  Eorce  Systems  Security  Manual  (AESSM)  7011  dated  1  May  1998. 
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Chapter  1 
INTRODUCTION 

1.1.  General.  A  major  goal  of  lA  is  to  assure  the  availability,  integrity,  and  confidentiality  of  informa¬ 
tion  and  information  systems.  To  this  end,  the  lA  disciplines  of  communications  security  (COMSEC), 
computer  security,  and  EMSEC  have,  of  necessity,  become  interdependent.  EMSEC  mostly  supports  the 
“confidentiality”  requirement. 

1.1.1.  The  objective  of  EMSEC  is  to  contain  compromising  emanations  within  an  inspectable  space 
(IS).  This  is  accomplished  by  identifying  requirements  from  the  broader  view  of  lA  and  providing  the 
appropriate  protection  at  the  least  possible  cost.  Key  to  this  is  a  partnership  between  the  lA  office  and 
the  user. 

1 . 1 . 1 . 1 .  The  wing  lA  office  assesses  the  need  for  EMSEC  as  part  of  lA;  it  determines  the  required 
countermeasures;  advises  commanders  of  vulnerabilities,  threats,  and  risks;  and  recommends  a 
practical  course  of  action. 

1 . 1 . 1 .2.  The  user  identifies  the  systems  that  will  process  classified  and,  in  some  instances,  unclas¬ 
sified  information;  the  volume,  relative  sensitivity,  and  perishability  of  the  information;  the  phys¬ 
ical  control  measures  in  effect  around  the  area  that  will  process  classified  information;  and  applies 
identified  countermeasures.  The  term,  "classified  information,"  as  used  in  this  AEMAN,  includes 
instances  of  unclassified  information.  Those  instances  are  defined  in  AESSI  7010  (will  become 
AEMAN  33-214,  Volume  1). 

1.1.2.  An  understanding  of  the  EMSEC  problem  is  essential  to  meeting  EMSEC  goals.  The  EMSEC 
problem  is  explained  in  AESSI  7010  (will  become  AEMAN  33-214,  Volume  1). 

1.1.3.  The  national  managers  used  risk  management  principles  to  develop  the  minimum  requirements 
identified  in  this  AEMAN.  Since  the  risk  has  been  accepted  at  the  national  level,  no  further  risk  for 
EMSEC  can  be  accepted. 

1.2.  Emission  Security  Process.  An  important  part  of  lA  is  the  certification  and  accreditation  (C&A) 
process.  The  C&A  process  addresses  vulnerabilities  and  threats  with  the  goal  of  reducing  the  risk  to  an 
acceptable  level.  EMSEC  is  part  of  the  C&A  process.  The  EMSEC  process  determines  protective  mea¬ 
sures  that  will  deny  unauthorized  persons  information  collected  from  the  intercept  and  analysis  of  emana¬ 
tions  from  information  systems  processing  classified  information.  The  EMSEC  assessment  determines  if 
the  threat  is  sufficient  to  require  an  EMSEC  countermeasures  review  for  information  systems,  communi¬ 
cations  systems,  and  cryptographic  equipment.  Eollowing  are  the  major  steps  and  where  they  fit  into  the 
C&A  process. 

1.2.1.  Basic  EMSEC  Process: 

1.2. 1.1.  The  user  contacts  the  wing  lA  office  whenever  classified  information  will  be  processed. 
The  user  must  do  this  before  processing  any  such  information. 

1.2. 1.2.  The  wing  lA  office  makes  the  information  systems,  communications  systems,  and  cryp¬ 
tographic  equipment  assessments  to  determine  the  need  for  EMSEC  countermeasures  and 
required  lA  countermeasures.  This  is  the  first  half  of  determining  the  EMSEC  portion  of  the  secu¬ 
rity  policy  for  the  C&A  of  the  information  system. 
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1.2. 1.3.  When  needed,  the  wing  lA  offiee  makes  the  information  systems,  eommunieations  sys¬ 
tems,  or  cryptographie  equipment  countermeasures  reviews  to  determine  specific  EMSEC  coun¬ 
termeasures  based  on  the  threat  for  that  location.  This  is  the  second  half  of  determining  the 
EMSEC  portion  of  the  security  policy  for  the  C&A  of  the  information  system. 

1.2. 1.4.  The  selection  of  EMSEC  countermeasures  is  validated  by  the  Air  Eorce  Certified  TEM¬ 
PEST  Technical  Authority  (CTTA)  at  HQ  AECA. 

1 .2. 1 .5.  The  required  countermeasures  are  given  to  the  user  for  application  or  implementation. 

1 .2. 1 .6.  The  wing  lA  office  inspects  the  application  of  countermeasures  for  correctness  and  effec¬ 
tiveness.  The  inspection  is  made  during  the  security  test  and  evaluation  task  of  the  C&A. 

1.2. 1.7.  The  wing  lA  office  certifies  the  information  system,  communications  system,  or  crypto¬ 
graphic  equipment  meets  EMSEC  requirements  as  part  of  the  certification  phase  of  the  C&A. 

1.2.2.  The  Different  EMSEC  Problems.  The  means  for  escape  of  compromising  emanations  are  dif¬ 
ferent  for  information  systems,  communications  systems,  and  cryptographic  systems;  therefore,  the 
EMSEC  process  is  established  to  treat  each  of  these  separately  to  address  their  individual  hazards. 

1.2. 2.1.  The  information  systems  countermeasures  review  determines  the  control  of  compromis¬ 
ing  emanations  required  for  information  systems  that  process  classified  information. 

1.2. 2. 2.  The  communications  systems  countermeasures  review  determines  the  countermeasures 
required  for  information  systems  that  process  classified  information  close  to  communications  sys¬ 
tems. 

1.2. 2. 3.  The  cryptographic  equipment  countermeasures  review  determines  the  countermeasures 
required  for  cryptographic  equipment. 

1.3.  Emission  Security  Countermeasures  Reviews.  Eike  the  EMSEC  assessments,  there  are  three 
EMSEC  countermeasures  reviews:  information  systems,  communications  systems,  and  cryptographic 
equipment.  Complete  each  review  separate  from  the  others  and  without  regard  to  the  outcome  of  the  oth¬ 
ers.  These  reviews  produce  the  EMSEC  requirements  for  the  information  system  under  review.  Document 
the  requirements  on  AE  Eorm  4170,  Emission  Security  Assessments/Emission  Security  Countermea¬ 
sures  Reviews.  The  AE  Eorm  4170  documents  EMSEC  requirements  and  is  the  basis  for  making  the 
EMSEC  inspection;  it  is  not  the  result  of  an  EMSEC  inspection. 

1.3.1.  Information  Systems.  Eollow  the  guidance  in  Chapter  2  to  make  the  information  systems 
countermeasures  review. 

1.3.2.  Communications  Systems.  Eollow  the  guidance  in  Chapter  3  for  the  communications  systems 
countermeasures  review. 

E3.3.  Cryptographic  Equipment.  Eollow  the  guidance  in  Chapter  4  for  the  cryptographic  equipment 
countermeasures  review. 

1.4.  Completing  the  Countermeasures  Reviews.  After  selecting  and  documenting  the  needed  counter¬ 
measures,  complete  documenting  the  countermeasures  reviews.  Classification  marking,  authentication, 
tracking,  validation,  informing  the  user,  inspection,  certification,  and  filing  procedures  are  in  Chapter  5. 
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1.5.  Maintaining  Emission  Security.  The  user  must  properly  maintain  the  EMSEC  eountermeasures 
and  equipment  used  to  process  classified  information.  Eollow  the  guidance  in  Chapter  6. 

1.6.  Emission  Security  Testing.  When  EMSEC  testing  is  needed  to  meet  EMSEC  requirements,  follow 
the  guidance  in  Chapter  7  to  request  EMSEC  testing. 

1.7.  Emission  Security  Countermeasures.  The  numerous  countermeasures  used  in  EMSEC  are  dis¬ 
cussed  in  Chapter  8.  Eor  each  countermeasure  there  is  a  discussion  of  the  problem  requiring  a  counter¬ 
measure,  what  the  countermeasure  is,  what  the  countermeasure  does,  what  conditions  negate  the  need  for 
the  countermeasure,  how  to  apply  the  countermeasure  when  required,  and  alternatives. 
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Chapter  2 

THE  INFORMATION  SYSTEMS  COUNTERMEASURES  REVIEW 

2.1.  Introduction.  When  the  need  to  control  compromising  emanations  is  indicated  by  the  information 
systems  assessment,  make  an  information  systems  countermeasures  review  to  determine  the  required  con¬ 
trol  of  compromising  emanations  countermeasures.  This  review  is  based  on  the  use  of  non-TEM- 
PEST-certified  equipment.  TEMPEST-certified  equipment  is  a  countermeasure.  The  Air  Eorce  CTTA 
must  validate  all  requirements  for  TEMPEST-certified  equipment.  The  possibility  of  the  intercept  of  com¬ 
promising  emanations  is  a  function  of  many  variables.  Chief  among  these  are  the: 

2.1.1.  Amount  of  inspectable  space  surrounding  the  systems  processing  classified  information. 

2.1.2.  Radiation  characteristics  of  the  systems  processing  classified  information. 

2.1.3.  Radio  frequency  attenuation  offered  by  the  facility  containing  the  systems  processing  classified 
information. 

2.1.4.  Eortuitous  conductors  near  the  systems  processing  classified  information. 

2.2.  Systematic  Approach.  The  Air  Eorce  uses  a  systematic  approach  to  determine  the  required  coun¬ 
termeasures  and  the  degree  to  which  they  are  applied.  Consider  the  following: 

2.2.1.  Eocation.  This  is  the  geographic  location  where  the  information  is  processed,  the  proximity  to 
establishments  of  countries  listed  in  Annex  C  of  National  Security  Telecommunications  and  Informa¬ 
tion  Systems  Security  Instruction  (NSTISSI)  7000,  (C)  TEMPEST  Countermeasures  for  Eacilities 
(U),  and  other  countries  that  could  pose  a  technical  threat  to  the  information. 

2.2.2.  Volume  of  Information  Processed.  This  is  the  total  volume  and  the  percentage  or  volume  of 
processed  information  at  the  UNCEASSIEIED,  SENSITIVE,  CONEIDENTIAE,  SECRET,  and  TOP 
SECRET  level. 

2.2.3.  Sensitivity  of  Information  Processed.  This  is  the  sensitivity  of  the  processed  information  (e.g.. 
Department  of  Energy  -  Restricted  Data;  Director  of  Central  Intelligence  -  Sensitive  Compartmented 
Information  [SCI];  Joint  Staff  -  Single  Integrated  Operational  Plan).  This  is  useful  in  determining  the 
likelihood  that  an  adversary  may  target  the  facility. 

2.2.4.  Perishability  of  Information  Processed.  The  processed  information  has  either  long-term  value 
(e.g.,  strategic)  or  short-term  value  (e.g.,  tactical).  Eong-term  information  requires  a  more  conserva¬ 
tive  approach  to  selecting  countermeasures  than  short-term  information. 

2.2.5.  Physical  Control.  This  is  the  physical  and  access  control  for  the  facility  and  area  containing  the 
system  under  review.  This  includes  guards  (number,  hours  of  posting,  patrols,  etc.),  badging,  control 
of  access  to  the  facility,  alarms,  procedures  to  monitor  or  control  uncleared  or  unauthorized  personnel 
including  custodial  and  janitorial  personnel,  vending  personnel,  and  telephone  and  power  maintainers 
and  installers.  Determine  the  level  of  authority  that  exists  for  the  inspection  or  removal  of  personnel 
who  could  potentially  exploit  compromising  emanations.  Examine  the  posting  of  warning  signs  and 
the  implementation  of  procedures  in  effect  to  exercise  control  over  parking  and  other  areas  adjacent  to 
or  in  close  proximity  to  the  facility  containing  the  system  under  review. 
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2.2.6.  TEMPEST  Profile  of  Equipment.  This  is  the  generie  or  aetual  TEMPEST  profile  information 
for  each  equipment  or  system  used  to  process  classified  information  in  the  facility.  Consider  existing 
on-site  EMSEC  test  results  for  the  facility. 

2.3.  Application  Requirement.  Apply  control  of  compromising  emanations  countermeasures  according 
to  the  instructions  in  this  chapter.  The  requirements  are  separate  from  other  EMSEC  requirements  (com¬ 
munications  systems  and  cryptographic  equipment).  Apply  them  even  when  there  are  no  other  EMSEC 
requirements.  Tactical  equipment  and  aircraft  are  excluded  from  this  universal  requirement.  See  Attach¬ 
ment  2  and  Attachment  3  for  transportable  systems  in  a  tactical  environment  and  aircraft-unique  require¬ 
ments. 

2.4.  Determine  the  Inspectable  Space.  When  it  is  required  to  control  compromising  emanations,  con¬ 
tain  them  within  the  inspectable  space.  In  the  planning  stages  for  large  projects,  the  user  contacts  the  lA 
office  as  soon  as  possible.  When  classified  information  is  to  be  processed,  the  lA  office  contacts  the 
installation’s  information  security  program  manager  or  reviews  Department  of  Defense  (DoD)  Regulation 
5200. 1-R,  Information  Security  Program,  January  1977,  for  secure  room  construction  standards,  and  oth¬ 
ers  responsible  for  constructing  or  modifying  a  building.  Even  for  projects  as  small  as  the  acquisition  of  a 
personal  computer  (PC),  the  user  consults  with  the  lA  office  early  to  identify  physical  security  require¬ 
ments.  Adopt  measures  to  meet  the  security  requirements  that  are  effective,  practical,  and  compatible  with 
local  policies  and  provisions. 

2.4.1.  The  lA  Office.  The  lA  office  identifies  the  inspectable  space  by  using  the  guidance  in  para¬ 
graph  2.4.3.  and  indicates  it  on  a  map  (see  Attachment  4).  Attach  the  map  to  the  AE  Eorm  4170,  doc¬ 
umenting  the  information  systems,  communications  systems,  and  cryptographic  equipment 
countermeasures  reviews.  The  map  of  the  inspectable  space  is  usually  unclassified. 

2.4.2.  The  CTTA.  The  CTTA  reviews  the  map  and  validates  the  identified  inspectable  space  as  com¬ 
plying  with  national  guidance.  This  determines  the  inspectable  space.  The  Defense  Intelligence 
Agency  (DIA/DAC-2A)  determines  inspectable  space  for  DIA-accredited  SCI  facilities. 

2.4.3.  Identifying  the  inspectable  space.  The  inspectable  space  is  not  intended  to  prevent  an  adversary 
from  making  a  technical  attack  but  rather  to  identify  the  area  where  the  chance  of  discovery  is  too 
risky  thereby  deterring  an  adversary.  Therefore,  the  inspectable  space  takes  advantage  of  existing 
physical  security. 

2.4.3. 1.  inspectable  space  is  defined  as  “the  three-dimensional  space  surrounding  systems  that 
process  classified  or  sensitive  information  within  which  TEMPEST  exploitation  is  not  considered 
practical  or  where  legal  authority  to  identify  or  remove  a  potential  TEMPEST  exploitation  exists.” 
This  definition  is  explained  as  follows: 

2.4. 3. 1.1.  Three-Dimensional  Space.  This  term  means  up  and  down  as  well  as  around. 

2.4.3. 1.2.  Not  Practical.  What  is  considered  not  practical?  Put  yourself  in  the  place  of  a  spy 
manager.  You  have  this  person  with  a  high  level  of  technical  knowledge,  trained  in  testing  and 
analysis,  and  3  to  5  years  of  experience.  You  equip  this  person  with  some  equipment  (not  spe¬ 
cially  built  but  it  is  expensive  in  total  cost;  several  receivers,  demodulators,  oscilloscope, 
video  monitor,  a  couple  of  recorders,  and  accessories).  So,  how  much  risk  are  you  going  to 
take  with  this  person?  It  is  extremely  unlikely  that  you  will  direct  this  person  to  set  up  a  TEM- 
PEST-exploitation  operation  on  a  military  installation.  If  the  information  is  vital  and  this  is  the 
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only  way  to  get  the  information,  you  might,  but  it  is  very  risky  because  the  person  will  have  to 
get  very  close  since  they  will  apply  many  countermeasures.  So,  as  the  lA  office,  keep  this  in 
mind  when  identifying  inspectable  space.  Also,  it  may  be  possible  to  include  exposed  places 
outside  a  military  installation  as  inspectable  space  since  the  adversary  does  not  want  to  be  dis¬ 
covered. 

2.4.3. 1.3.  Legal  Authority  to  Identify  or  Remove  a  Potential  TEMPEST  Exploitation.  The 
United  States  (U.S.)  Government  certainly  has  that  authority  on  every  base  in  the  United 
States,  its  trust  territories,  and  possessions  (hereafter  called  the  United  States),  but,  what  about 
bases  under  foreign  control?  On  some  bases  under  foreign  control,  the  U.S.  Government  does 
have  the  authority  to  identify  or  remove,  in  concert  with  the  host  nation’s  security  people.  That 
counts  as  inspectable  space.  What  about  a  base  in  a  country  where  the  U.S.  Government  has  all 
that  but  the  host  country  has  areas  where  U.S.  personnel  are  not  authorized  to  visit,  either  not 
at  all  or  not  without  prior  notice.  The  key  here  is  access.  If  prior  notice  of  less  than  one  hour  is 
required,  then  the  U.S.  Government  has  access.  If  prior  notice  of  more  than  one  hour  is 
required,  then  the  U.S.  Government  does  not  have  access  and  that  area  is  not  considered  as 
inspectable  space. 

2.4. 3. 2.  Take  advantage  of  circumstances  that  keep  adversaries  away  or  increase  either  the  physi¬ 
cal  distance  or  the  zone  rating. 

2.4.3.2.1.  Eor  radiated  compromising  emanations,  6  inches  of  reinforced  concrete  provides  a 
nominal  20  decibels  (dB)  of  attenuation.  When  the  inspectable  space  is  defined  in  distance,  a 
steel  pan,  poured  concrete  floor,  or  ceiling  will  provide  about  20  dB  of  attenuation  adding  one 
zone  level  to  the  inspectable  space  in  that  direction.  That  is,  when  the  inspectable  space  is  1 
meter  but  less  than  20  meters  (Zone  A)  the  inspectable  space  becomes  Zone  B  or  when  the 
inspectable  space  is  20  meters  but  less  than  100  meters  (Zone  B)  the  inspectable  space 
becomes  Zone  C,  etc.  This  is  because  the  zones  are  16  dB  apart.  An  8-inch  thick  reinforced 
concrete  wall  offers  about  12  dB  of  attenuation  or  about  3/4  of  a  zone.  Cinder  block  and  brick 
walls  offer  about  4  dB  of  attenuation  or  about  1/4  of  a  zone. 

2. 4. 3. 2. 2.  Eor  conducted  compromising  emanations,  look  for  things  that  prevent  access  to 
conductors  (like  the  building  is  totally  within  the  inspectable  space  so  heating  and  air  condi¬ 
tioning  ducts  and  water  pipes  are  not  accessible)  or  would  reduce  the  magnitude  of  any  com¬ 
promising  emanations  on  a  conductor. 

2.4. 3. 3.  Identify  the  inspectable  space  boundary  and  indicate  it  on  the  map.  Base  the  decision  on 
how  willing  an  adversary  is  to  risk  an  asset  and  U.S.  Government  access  to  areas  considered  as 
inspectable  space. 

2.4.4.  Multiple  Use  of  the  inspectable  space  Map.  Once  the  inspectable  space  is  determined  and  the 
map  made,  it  can  be  used  for  all  other  countermeasures  reviews  of  systems  within  that  inspectable 
space. 

2.4.5.  When  Changes  Occur.  Reaccomplish  all  information  systems  countermeasures  reviews  when 
the  inspectable  space  shrinks  or  expands. 

2.5.  Identify  Equipment  TEMPEST  Characteristics.  The  methods  for  identifying  the  equipment 
TEMPEST  characteristics  are  listed  in  preferred  sequence.  Ask  your  major  command  (MAJCOM)  lA 
office  for  assistance  if  you  do  not  have  the  information  you  need. 
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2.5.1.  Equipment  TEMPEST  Zone  Rating.  Use  the  TEMPEST  zone  assignment  for  information  pro¬ 
cessing  equipment  to  find  the  equipment  TEMPEST  zone  ratings.  Obtain  this  from  the  MAJCOM  lA 
office. 

2.5.2.  TEMPEST  Eevel  Rating.  Use  the  level  assignment  (I,  II,  or  III)  for  the  system  based  on 
EMSEC  test  results.  The  equipment  radiation  TEMPEST  zone  (ERTZ)  may  be  used  if  known. 

2.5.3.  Generic  Zone  Assignment.  HQ  AECA/TCBA  developed  the  generic  zone  assignment  and  is  an 
average  of  like  equipment.  Use  Attachment  5  for  the  zone  assignment  for  the  kind  of  equipment  used. 

2.5.4.  Other  Guidance.  If  the  equipment  under  review  is  not  identified  in  any  of  the  above  sources, 
use  the  category  "All  Other  RED  Equipment." 

2.6.  Selecting  Countermeasures. 

2.6.1.  Radiated  Compromising  Emanations.  Using  the  equipment  TEMPEST  characteristics,  identify 
the  amount  of  inspectable  space  required  to  contain  radiated  compromising  emanations  within  the 
inspectable  space. 

2.6.2.  Conducted  Compromising  Emanations.  Use  Table  2.1.  to  identify  which  attachment  (Attach¬ 
ment  6,  Attachment  7,  Attachment  8,  Attachment  9,  Attachment  10,  Attachment  11,  Attachment 
12,  Attachment  13,  or  Attachment  14)  has  the  basic  selection  of  countermeasures  to  contain  con¬ 
ducted  compromising  emanations  within  the  inspectable  space.  To  do  this,  find  the  column  across  the 
top  of  Table  2.1.  that  includes  the  facility  zone  rating  or  the  minimum  amount  of  inspectable  space 
identified  in  paragraph  2.4.  Then  find  the  row  along  the  left  side  of  Table  2.1.  that  includes  the  worst 
case  equipment  TEMPEST  characteristics  identified  in  paragraph  2.5.  Eollow  the  column  down  and 
the  row  in  until  they  intersect.  Eollow  the  directions  in  the  applicable  attachment  to  select  required 
countermeasures . 


Table  2.1.  Countermeasures  Requirements. 


FACILITY  ZONE 

OR 

INSPECTABLE  SPACE  (IS) 

Facility  Zone  A 

OR 

IS  less  than  20 
meters 

Facility  Zone  B 

OR 

IS  more  than  20 

meters, 

less  than  100 

meters 

Facility  Zone  C 

OR 

IS  more  than  100 
meters 

Equipment 

Zone  A,  or 

ERTZ  =  1  meter,  or 

Meets  NSTISSAM/TEMPEST 
1-92,  (C)  Compromising  Emana¬ 
tions  Laboratory  Test  Require¬ 
ments,  Electromagnetics  (U), 
Eevel  I 

Go  to 

Attachment  6 

Go  to 

Attachment  7 

Go  to 

Attachment  8 

Zone  B,  or 

ERTZ  =  1  meter  to  20  meters,  or 
Meets  NSTISSAM/TEMPEST 
1-92,  Eevel  II 

Go  to 

Attachment  9 

(See  Note) 

Go  to 

Attachment  10 

Go  to 

Attachment  11 
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FACILITY  ZONE 

OR 

INSPECTABLE  SPACE  (IS) 

Facility  Zone  A 

OR 

IS  less  than  20 
meters 

Facility  Zone  B 

OR 

IS  more  than  20 

meters, 

less  than  100 

meters 

Facility  Zone  C 

OR 

IS  more  than  100 
meters 

Equipment 

Zone  C,  or 

ERTZ  =  20  meters  to  100  meters, 

or 

Meets  NSTISSAM/TEMPEST 
1-92,  Eevel  III,  or 

All  Other  RED  Equipment 

Go  to 

Attachment  12 

(See  Note) 

Go  to 

Attachment  13 

(See  Note) 

Go  to 

Attachment  14 

NOTE:  This  installation  may  create  serious  TEMPES" 
the  actual  TEMPEST  zone  test  results  for  the  equipme 
use  the  equipment  in  the  facility. 

"  hazards.  Contact  your  CTTA  to  evaluate 
nt  and  the  facility  to  determine  if  you  can 

2.6.2. 1.  Select  those  countermeasures  identified  as  required  unless  there  is  a  reason  not  to.  Look 
for  a  reason  not  to  select  a  countermeasure.  Keep  in  mind  the  factors  identified  in  paragraph  2.2. 
Balance  those  factors  against  such  things  as:  the  cost  to  the  adversary,  the  adversary’s  access  to  the 
system,  the  risk  of  discovery,  the  objectives  of  the  adversary,  and  the  impact  on  the  user’s  mission. 
The  bottom  line  is:  select  it  if  it’s  needed,  do  not  select  it  if  it  is  not.  Explain  why  each  deselected 
required  countermeasure  was  not  selected.  A  waiver  is  not  needed  for  any  deselected  required 
countermeasure  since  the  requirement  for  protection  has  been  met. 

2. 6. 2. 2.  Consider  other  listed  countermeasures  within  the  attachment  using  the  environment  and 
the  TEMPEST  characteristics  of  the  equipment.  Do  not  select  one  unless  there  is  a  reason  to  apply 
it.  Base  the  selection  of  any  additional  countermeasures  on  the  situation  (sensitivity,  perishability, 
threat  level,  inspectable  space,  equipment  TEMPEST  profile,  construction,  and  layout).  You  must 
explain  why  each  selected  nonrequired  countermeasure  was  selected  (i.e.,  identify  a  threat). 

2. 6. 2. 3.  To  aid  the  EMSEC  person  making  a  countermeasures  review,  a  brief  discussion  of  each 
countermeasure  is  contained  in  Chapter  8.  The  discussion  identifies  the  basic  compromising  ema¬ 
nation  problem  the  countermeasure  is  designed  to  control  and  contains  an  explanation  of  how  the 
countermeasure  works.  When  there  are  options,  optional  ways  to  treat  the  hazard  are  identified. 

2.7.  Estimating  Cost.  Estimate  the  cost  of  each  selected  countermeasure  and  enter  that  cost  after  the 
countermeasure  on  the  AE  Eorm  4170. 

2.8.  Analyzing  the  Results.  Analyze  the  results  and  determine  if  they  are  acceptable  (i.e.,  reasonable, 
practical,  and  cost  effective).  If  the  results  are  not  acceptable,  request  assistance  from  your  MAJCOM  lA 
office.  If  the  results  are  acceptable,  continue. 

2.9.  Documenting  the  Results.  Document  the  results  by  identifying  the  required  inspectable  space  and 
countermeasures  on  AE  Eorm  4170,  Part  II,  following  the  instructions  in  Attachment  4  for  information 
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systems.  Remember  that  the  form  establishes  EMSEC  requirements.  It  must  elearly  state  to  the  user  what 
is  required.  It  is  not  an  inspeetion  report. 

2.10.  Completing  the  Information  Systems  Countermeasures  Review.  If  the  communications  sys¬ 
tems  or  cryptographic  equipment  assessment  indicated  the  need  for  either  a  communications  systems  or 
cryptographic  equipment  countermeasures  review,  make  the  review  before  completing  the  countermea¬ 
sures  review  according  to  Chapter  5. 
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Chapter  3 

THE  COMMUNICATIONS  SYSTEMS  COUNTERMEASURES  REVIEW 

3.1.  Introduction.  When  the  need  for  communications  systems  countermeasures  is  indicated  by  the 
communications  systems  assessment,  the  communications  systems  countermeasures  review  determines 
the  required  countermeasures.  Selection  is  a  function  of  many  variables.  Chief  among  these  are  the: 

3.1.1.  Separation  distance  between  RED  equipment  and  radio  equipment. 

3.1.2.  Radiation  characteristics  of  the  systems  processing  classified  information. 

3.1.3.  Radio  frequency  attenuation  offered  by  the  facility  containing  the  systems  processing  classified 
information. 

3.2.  Installation  Requirement.  Install  equipment  that  processes  classified  information  according  to  the 
instructions  in  this  chapter.  The  communications  systems  installation  requirements  are  separate  from 
other  EMSEC  requirements.  Meet  them  even  when  there  are  no  other  EMSEC  requirements. 

3.3.  Transmitting  Equipment.  Use  the  guidance  in  this  paragraph  except  when  the  equipment  is 
addressed  in  paragraph  3.4. 

3.3.1.  Equipment  Separation  Requirements.  This  countermeasure  is  required.  Separation  guidance 
for  fixed  transmitters  and  transceivers  (transmitters  and  receivers  contained  in  one  unit)  is  based  on 
the  TEMPEST  characteristics  of  the  RED  equipment.  Separate  RED  equipment  from  transmitters 
according  to  Table  3.1. 

3.3.2.  Power  Requirements.  This  countermeasure  is  required.  Do  not  power  RED  equipment  from  the 
same  electrical  circuit  as  radio  frequency  transmitters  and  any  ancillary  equipment,  such  as  control 
heads,  connected  to  radio  frequency  transmitters.  Install  a  separate  power  circuit  for  either  the  RED 
equipment  or  the  radio  frequency  transmitter  and  any  ancillary  equipment.  The  separate  power  circuit 
is  established  at  the  circuit-breaker  panel.  It  is  permissible  to  power  both  from  the  same  electrical  cir¬ 
cuit  if  either  the  RED  equipment  or  the  radio  frequency  transmitter  and  any  ancillary  equipment  are 
equipped  with  power  line  filters. 


Table  3.1.  Separation  Requirements  for  Transmitters. 


Equipment  Radiation  TEMPEST  Zone 

SEPARATION  DISTANCE 

Zone  A,  or  less  than  3  meters 

2  meters 

Zone  B,  or  3  meters  to  20  meters 

3  meters 

Zone  C,  or  20  meters  to  100  meters 

5  meters 

Zone  D,  or  over  100  meters 

10  meters 

3.3.3.  Signal  and  Control  Eines  Separation  Requirements.  This  countermeasure  is  required.  These  are 
BEACK  lines.  If  they  are  wire  lines: 

3.3.3. 1.  Separate  transmitter  signal  and  control  wire  lines  from  RED  equipment  by  the  distance 
specified  in  Table  3.2.  or  shield  them.  The  separation  requirement  for  shielded  signal  and  control 
wire  lines  from  RED  equipment  is  reduced  to  15  centimeters. 
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3. 3. 3. 2.  Separate  transmitter  signal  and  control  wire  lines  from  RED  wire  lines,  RED  power  lines, 
and  RED  signal  ground  wire  lines  0.5m  or  shield  them.  The  separation  requirement  for  shielded 
signal  and  control  wire  lines  from  RED  wire  lines,  RED  power  lines,  and  RED  signal  ground  wire 
lines  is  reduced  to  5  centimeters. 

3. 3. 3. 3.  There  are  no  separation  requirements  for  fiber  optic  signal  and  control  lines. 

3. 3. 3.4.  If  the  separation  distances  for  signal  and  control  wire  lines  cannot  be  achieved,  shield  the 
wire  lines,  filter  the  wire  lines,  use  opto-isolators,  or  use  fiber  optic  lines  instead  of  wire  lines. 


Table  3.2.  Separation  Requirements  for  Signal  and  Control  Wire  Lines. 


EQUIPMENT  RADIATION  TEMPEST  ZONE 

SEPARATION  DISTANCE 

Zone  A,  or  less  than  3  meters 

0.5  meters 

Zone  B,  or  3  meters  to  20  meters 

1  meter 

Zone  C,  or  20  meters  to  100  meters 

2  meters 

Zone  D,  or  over  100  meters 

3  meters 

3.3.4.  Remote  Control  Head  Separation  Requirements.  This  countermeasure  is  required.  Determine  if 
the  control  head  is  passive  or  active.  Passive  control  heads  have  no  electronic  circuits  with  active 
devices  in  them  (e.g.,  computer  chips,  junctions,  registers,  etc.);  mechanical  switches  or  mechanical 
relays  do  all  the  switching.  Active  control  heads  have  electronic  circuits  activated  by  front-panel  but¬ 
tons  or  switches  or  use  a  computer  to  control  operator  selections. 

3.3.4. 1.  Separate  active  control  heads  by  the  distance  specified  in  Table  3.2. 

3. 3. 4. 2.  Separate  passive  control  heads  from  RED  equipment,  RED  wire  lines,  RED  power  lines, 
and  RED  signal  ground  lines  by  the  same  distance  as  determined  in  paragraph  3.3.3.2. 

3. 3. 4. 3.  If  the  separation  distance  cannot  be  achieved,  use  opto-isolators  on  the  signal  and  control 
wire  lines  to  the  transmitter  or  use  fiber  optic  signal  and  control  lines  instead  of  wire  lines. 

3.3.5.  Shielding  Alternative.  An  alternative  to  the  separation  requirement  in  paragraph  3.3.1.  is 
shielding  either  the  RED  equipment  or  the  transmitter.  If  the  transmitter  is  shielded,  a  part  of  the 
shielding  must  include  the  antenna  lead.  Circumferentially  bond  the  antenna  lead  shield  to  the 
shielded  enclosure.  Extend  the  shield  to  a  distance  20  times  the  diameter  of  the  shield.  You  must  use 
filters  to  penetrate  the  shielding  for  power,  signal,  and  control  lines.  If  signal  or  control  lines  are  fiber 
optic,  a  waveguide  beyond  cutoff  penetration  may  be  used.  Keep  the  diameter  as  small  as  possible  not 
exceeding  one-half  inch.  Make  the  length  of  the  waveguide  10  times  the  diameter. 

3.4.  Special  Items.  Use  the  guidance  in  this  paragraph  for  the  items  addressed  in  this  paragraph  instead 
of  the  guidance  in  paragraph  3.3.  People  may  innocently  introduce  other  radio  devices,  such  as  pagers, 
hand-held  portable  transceiver  radios,  cellular  telephones,  cordless  telephones,  and  cordless  microphones 
into  the  area  processing  classified  information  with  disastrous  results.  Also,  alarm  systems  may  use  radio 
transmitters  to  alert  remotely  located  security  or  fire-fighting  teams. 

3.4.1.  Hand-Held  Radios.  These  countermeasures  are  required.  Hand-held  radio  transceivers  used 
with  intrabase  radios  and  land  mobile  radios  deserve  special  consideration  because  of  their  unique 
operational  applications.  A  person  may  carry  these  devices  into  an  area  where  classified  information 
is  processed.  If  the  person  carrying  such  a  device  works  in  the  facility,  either  turn  off  the  device  and 
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use  the  telephone  or  separate  it  2  meters  from  classified  processors;  no  transmissions  are  allowed.  If 
the  person  carrying  the  device  is  a  short-term  visitor,  it  is  not  necessary  to  turn  off  the  radio  because 
the  visitor  usually  moves  about  in  the  facility.  Infrequent  transmissions  are  allowed,  but  only  for  short 
durations. 

3.4.2.  Beepers  and  Pagers.  These  countermeasures  are  required.  Beepers  and  pagers  deserve  special 
consideration  because  of  their  unique  operational  applications.  A  person  may  carry  these  devices  into 
an  area  where  classified  information  is  processed.  If  the  person  carrying  such  a  device  works  in  the 
facility,  either  turn  off  the  device  and  use  the  telephone  or  keep  the  device  2  meters  from  classified 
processors.  If  the  person  carrying  the  device  is  a  short-term  visitor,  it  is  not  necessary  to  turn  off  the 
device  because  the  visitor  usually  moves  about  in  the  facility.  If  the  device  has  a  transmit  capability, 
follow  the  instructions  for  hand-held  radios. 

3.4.3.  Alarm  Systems.  These  countermeasures  are  required.  The  mode  of  operation  of  alarm  systems 
radio  frequency  transmitters  will  determine  their  treatment.  Any  such  transmitter  with  a  continuous 
transmit  mode  or  a  high  duty  cycle  (transmits  most  of  the  time)  must  meet  the  same  separation 
requirements  as  all  other  fixed  transmitters;  follow  the  applicable  guidance  in  paragraph  3.3.  If  they 
do  not  meet  these  requirements,  exclude  them  from  operating  in  the  classified  information  processing 
area.  Low  duty  cycle  (transmits  short  bursts  infrequently)  systems  are  not  considered  hazards  and 
require  no  special  treatment. 

3.4.4.  Cellular  Telephones.  These  countermeasures  are  required.  When  a  cellular  telephone  is  used  as 
an  operational  necessity,  separate  it  5  meters  from  RED  equipment.  When  the  cellular  telephone  is  a 
personal  asset,  disable  the  unit  from  receiving  calls  or  separate  it  10  meters  from  RED  processors. 
Cellular  telephones  are  excluded  from  operating  within  10  meters  of  the  classified  information  pro¬ 
cessing  area  when  the  facility  is  located  outside  the  United  States. 

3.4.5.  Cordless  Telephones.  These  countermeasures  are  required.  When  a  radio  frequency  cordless 
telephone  is  used  as  an  operational  necessity,  separate  it  5  meters  from  RED  equipment.  When  the 
cordless  telephone  is  a  personal  asset,  its  use  is  prohibited.  Disable  the  personal  cordless  telephone 
from  receiving  calls  or  separate  it  10  meters  from  RED  processors.  There  are  no  separation  require¬ 
ments  for  infrared  cordless  telephones.  Cordless  telephones  are  excluded  from  operating  within  10 
meters  of  the  classified  information  processing  area  when  the  facility  is  located  outside  the  United 
States. 

3.4.6.  Cordless  Microphones. 

3.4.6. 1.  Radio  Erequency  Cordless  Microphones.  These  countermeasures  are  required.  When  a 
radio  frequency  cordless  microphone,  encrypted  or  unencrypted,  is  used  for  briefing  either  classi¬ 
fied  information  or  unclassified  information,  separate  it  5  meters  from  RED  equipment.  Using 
unencrypted  radio  frequency  cordless  microphones  for  classified  briefings  is  prohibited. 

3.4. 6. 2.  Infrared  Cordless  Microphones.  These  countermeasures  are  required.  Using  an  infrared 
cordless  microphone  for  briefing  classified  information  requires  blocking  the  line  of  sight  to  a 
possible  place  where  an  adversary  could  detect  the  infrared  emanations.  Do  not  forget  that  smooth 
or  shiny  surfaces  cause  infrared  signals  to  be  reflected.  The  best  solution  is  to  use  a  closed  room, 
keeping  the  doors  closed  and  covering  the  windows  with  drapes. 

3.4.7.  Cordless  Accessories.  These  countermeasures  are  required.  When  a  radio  frequency  cordless 
accessory  such  as  a  keyboard  or  a  mouse  is  used,  separate  it  5  meters  from  RED  equipment.  Radio  fre¬ 
quency  cordless  accessories  cannot  be  used  to  process  classified  information  unless  encrypted. 
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3.4.8.  Wireless  Local  Area  Networks  (LAN).  These  countermeasures  are  required.  When  a  radio  fre¬ 
quency  wireless  LAN  is  used,  separate  the  transmitter  and  receiver  units  5  meters  from  RED  equip¬ 
ment. 

3.4.9.  Infrared  LANs.  These  countermeasures  are  required.  An  infrared  LAN  processing  classified 
information  requires  blocking  the  line  of  sight  to  a  possible  place  where  an  adversary  could  detect  the 
infrared  emanations.  Do  not  forget  that  smooth  or  shiny  surfaces  cause  infrared  signals  to  be  reflected. 
The  best  solution  is  to  use  a  closed  room,  keeping  the  doors  closed  and  covering  the  windows  with 
drapes. 

3.4.10.  Infrared  Devices.  These  countermeasures  are  required.  Infrared  devices  not  covered  by  any 
subparagraph  of  paragraph  3.4.  require  blocking  the  line  of  sight  to  a  possible  place  where  an  adver¬ 
sary  could  detect  the  infrared  emanations.  Do  not  forget  that  smooth  or  shiny  surfaces  cause  infrared 
signals  to  be  reflected.  The  best  solution  is  to  use  a  closed  room,  keeping  the  doors  closed  and  cover¬ 
ing  the  windows  with  drapes. 

3.5.  Estimating  Cost.  Estimate  the  cost  of  each  selected  countermeasure  and  enter  that  cost  after  the 
countermeasure  on  the  AE  Eorm  4170. 

3.6.  Analyzing  the  Results.  Analyze  the  results  and  determine  if  they  are  acceptable  (i.e.,  reasonable, 
practical,  and  cost  effective).  If  the  results  are  not  acceptable,  request  assistance  from  your  MAJCOM  lA 
office.  If  the  results  are  acceptable,  continue. 

3.7.  Documenting  the  Results.  Document  the  results  that  identify  the  required  countermeasures  on  AE 
Eorm  4170,  Part  II,  following  the  instructions  in  Attachment  4  for  communications  systems.  Remember, 
the  form  establishes  EMSEC  requirements.  It  must  clearly  state  to  the  user  what  is  required.  It  is  not  an 
inspection  report. 

3.8.  Completing  the  Information  Systems  Countermeasures  Review.  If  the  cryptographic  equipment 
assessment  indicated  the  need  for  a  cryptographic  equipment  countermeasures  review,  make  the  review 
before  completing  the  countermeasures  reviews  according  to  Chapter  5. 
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Chapter  4 

THE  CRYPTOGRAPHIC  EQUIPMENT  COUNTERMEASURES  REVIEW 

4.1.  Introduction.  When  the  need  for  cryptographic  equipment  countermeasures  is  indicated  by  the 
cryptographic  equipment  assessment,  the  cryptographic  equipment  countermeasures  review  determines 
the  required  countermeasures.  The  possibility  of  the  escape  of  classified  information  is  a  function  of  many 
variables.  Chief  among  these  are  the: 

4.1.1.  Separation  distance  between  RED  equipment  and  cryptographic  equipment. 

4.1.2.  Radiation  characteristics  of  the  systems  processing  classified  information. 

4.1.3.  Type  of  information  processed. 

4.2.  Installation  Requirement.  Install  cryptographic  equipment  according  to  the  instructions  in  this 
chapter.  The  cryptographic  equipment  installation  requirements  are  separate  from  other  EMSEC  require¬ 
ments.  Meet  them  even  when  there  are  no  other  EMSEC  requirements. 

4.3.  Secure  Telephone  Unit-HI  (STU-IH),  Secure  Terminal  Equipment  (STE),  and  Like  Items. 

These  countermeasures  are  required  for  STU-III,  STE,  and  secure  data  devices  (SDD).  Do  the  following 
when  connecting  ancillary  items  such  as  computers  and  facsimile  (EAX)  machines  to  the  secure  digital 
data  port: 

4.3.1.  Separate  the  STU-III,  STE,  or  SDD  I  meter  from  the  RED  equipment. 

4.3.2.  Use  the  manufacturers’  shielded  cable  to  connect  the  STU-III,  STE,  or  SDD  to  the  RED  equip¬ 
ment.  If  the  manufacturers’  shielded  cable  is  not  available,  use  a  generic  shielded  cable. 

4.4.  Cryptographic  System  KIV-7.  These  countermeasures  are  required  for  KIV-7  cryptographic  sys¬ 
tems. 

4.4.1.  Do  the  following  when  the  KIV-7  is  installed  in  a  computer: 

4.4. 1.1.  Do  not  use  the  computer’s  internal  modem;  use  an  external  modem. 

4.4. 1.2.  Separate  the  external  modem  1  meter  from  the  RED  equipment. 

4.4. 1.3.  Use  the  cables  (for  installing  the  KIV-7  in  a  computer)  made  by  the  KIV-7  manufacturer. 
All  cables  not  made  by  the  manufacturer  must  meet  the  same  requirements  as  the  manufacturer’s 
cables. 

4. 4. 1.4.  There  are  no  separation  requirements  between  the  KIV-7  and  RED  or  BEACK  equip¬ 
ment. 

4.4.2.  Do  the  following  when  installing  the  KIV-7  in  a  rack  near  a  computer: 

4.4.2. 1.  Do  not  use  the  computer’s  internal  modem;  use  an  external  modem. 

4. 4. 2. 2.  Use  the  cables  (for  installing  the  KIV-7  in  a  rack  near  a  computer)  made  by  the  KIV-7 
manufacturer.  All  cables  not  made  by  the  manufacturer  must  meet  the  same  requirements  as  the 
manufacturer’s  cables. 
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4. 4. 2. 3.  A  rack  is  not  required  if  the  KIV-7  is  not  installed  in  a  computer.  When  installing  the 
KIV-7  in  an  external  rack,  use  the  manufacturer’s  supplied  rack.  If  you  are  not  using  a  rack  made 
by  the  manufacturer,  your  rack  must  meet  the  same  requirements  as  the  manufacturer’s  rack. 

4.4. 2.4.  Separate  the  modem  1  meter  from  the  RED  equipment. 

4. 4. 2. 5.  There  are  no  separation  requirements  between  the  KIV-7  and  RED  or  BEACK  equip¬ 
ment. 

4.4.3.  Do  the  following  when  the  KIV-7  is  installed  in  a  stand-alone  mode  (similar  to  a  cryptographic 
room): 

4.4.3. 1.  Do  not  use  the  internal  modem  of  an  equipment  processing  classified  information  unless 
the  equipment  is  TEMPEST  certified.  Use  an  external  modem. 

4.4. 3. 2.  Connect  the  KIV-7  to  BEACK  power. 

4.4. 3. 3.  Shield  both  the  RED  and  BEACK  wire  lines.  Connect  the  shields  to  the  appropriate  RED 
and  BEACK  signal  grounds. 

4.4. 3.4.  A  rack  is  not  required  if  the  KIV-7  is  not  installed  in  a  computer.  Whenever  possible,  use 
the  manufacturer’s  supplied  rack.  If  you  are  not  using  a  rack  made  by  the  manufacturer,  your  rack 
must  meet  the  same  requirements  as  the  manufacturer’s  rack. 

4. 4. 3. 5.  There  are  no  separation  requirements  between  the  KIV-7  and  RED  or  BEACK  equip¬ 
ment. 

4.5.  FORTEZZA  For  Classified  (FFC).  These  countermeasures  are  required  for  FFC  cryptographic 
systems.  Do  the  following  when  using  a  FFC  card  to  secure  a  computer: 

4.5.1.  Do  not  use  the  internal  modem  if  one  is  installed  in  the  computer;  use  an  external  modem.  The 
only  exception  is  the  palladium  modem  card  associated  with  the  remote  access  security  program. 

4.5.2.  Separate  the  modem  1  meter  from  the  RED  equipment. 

4.5.3.  There  are  no  separation  requirements  between  the  FFC  card  and  RED  or  BEACK  equipment. 

4.5.4.  Separate  RED  equipment  from  BEACK  equipment  according  to  control  of  compromising  ema¬ 
nations  requirements. 

4.6.  Electronic  Key  Management  System  (EKMS).  The  EKMS  processes  and  manages  cryptographic 
key  in  electronic  form.  The  basic  unit  consists  of  a  key  processor  and  a  computer.  Associated  with  the 
EKMS  is  either  a  STU-III,  STE,  SDD,  or  other  cryptographic  equipment  and  a  data  transfer  device  (DTD) 
or  laptop  computer. 

4.6.1.  Within  the  basic  setup  of  the  EKMS  there  is  no  separation  requirements.  The  cables  are  not 
long  enough  for  the  standard  1 -meter  RED  and  BEACK  equipment  separation.  The  basic  unit  was 
tested  and  meets  TEMPEST  requirements.  Testing  also  included  the  STU-III,  STE,  SDD,  other  cryp¬ 
tographic  equipment,  and  a  DTD. 

4.6.2.  External  to  the  basic  setup  of  the  EKMS,  these  countermeasures  are  required: 

4.6.2. 1 .  Connect  the  EKMS  to  BEACK  power. 

4. 6. 2. 2.  Separate  the  EKMS  from: 
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4.6.2.2.1.  Other  RED  equipment  and  BLACK  equipment  by  1  meter.  Separate  the  EKMS 
from  other  TEMPEST-certified  equipment  by  5  centimeters. 

4. 6. 2.2. 2.  Power  lines  by  5  centimeters. 

4. 6. 2. 2. 3.  Other  RED  and  BLACK  wire  lines  by  5  centimeters. 

4.7.  All  Other  Cryptographic  Equipment.  These  countermeasures  are  required.  In  a  facility  where  all 
the  equipment  on  the  RED  side  of  the  cryptographic  equipment  is  considered  RED,  the  installation  of  the 
cryptographic  equipment  must  follow  the  installation  standards  in  the  technical  publications  related  to  the 
cryptographic  equipment.  If  not  specified,  the  following  countermeasures  are  required: 

4.7.1.  Do  not  use  the  computer’s  internal  modem;  use  an  external  modem. 

4.7.2.  Connect  the  cryptographic  equipment  to  BLACK  power.  Shield  the  BLACK  power  distribu¬ 
tion  facility  when  not  costly. 

4.7.3.  Shield  both  the  RED  and  BLACK  wire  lines.  Connect  the  shields  to  the  appropriate  RED  and 
BLACK  signal  grounds.  Cryptographic  equipment  is  designed  for  use  with  shielded  cables.  The 
shields  from  these  cables  are  grounded  through  the  connector  backshell  to  the  appropriate  ground  in 
the  equipment. 

4.7.4.  RED  and  BLACK  signal  grounds  are  not  required  except  for  facilities  where  the  signal  ground 
is  not  totally  contained  within  the  inspectable  space.  Use  RED  and  BLACK  signal  grounds  if  already 
installed  and  are  within  10  meters  of  the  cryptographic  equipment. 

4.7.5.  Separate  cryptographic  equipment  from: 

4.7.5. 1.  RED  equipment  and  BLACK  equipment  by  1  meter.  Separate  cryptographic  equipment 
from  TEMPEST-certified  equipment  by  5  centimeters. 

4.7. 5. 2.  Power  lines  by  5  centimeters. 

4.7. 5. 3.  RED  and  BLACK  wire  lines  by  5  centimeters. 

4.7.6.  Separate  the  RED  and  BLACK  cables  connected  to  the  cryptographic  equipment  by  5  centime¬ 
ters. 

4.7.7.  Separate  RED  and  BLACK  patch  panels  and  connection  facilities  by  1  meter  (e.g.,  distribution 
frames). 

4.8.  Changing  From  Unclassified  to  Classified  Processing.  These  countermeasures  are  required  when 
it  is  a  fixed  facility  like  weather  (generally,  weather  information  is  considered  unclassified  in  peace  time 
but  may  become  classified  during  war  time).  The  guidance  here  is  not  intended  for  day-to-day  use  where 
classified  information  is  processed  for  a  short  time  intermixed  with  processing  unclassified  information. 
In  those  cases,  the  equipment  is  considered  RED  all  the  time.  If  the  facility  has  equipment  on  the  RED 
side  of  the  cryptographic  equipment  that  does  not  process  classified  information  now  but  may  process 
classified  information  in  the  future,  follow  these  special  installation  procedures  for  this  unique  channel. 
There  are  two  conditions  that  may  exist: 

4.8.1.  Condition  One.  If  the  facility  is  all  BLACK,  treat  the  potentially  RED  equipment  on  the  RED 
side  of  the  cryptographic  equipment  as  RED  equipment. 
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4. 8. 1.1.  Isolate  the  potentially  RED  equipment  in  the  same  way  that  RED  equipment  is  isolated. 
That  is,  no  unprotected  connections  outside  the  future  secure  area. 

4.8.1 .2.  Separate  the  potentially  RED  equipment  from  other  BEACK  equipment  as  if  it  were  RED 
equipment. 

4.8.  E3.  Eollow  the  installation  guidance  in  paragraph  4.5. 

4.8.2.  Condition  Two.  If  the  facility  presently  contains  both  RED  and  BEACK  equipment,  and  the 
user  cannot  properly  isolate  the  potentially  RED  equipment  on  the  RED  side  of  the  cryptographic 
equipment  to  meet  RED  equipment  standards  (e.g.,  it  is  connected  to  outside  BEACK  sources),  then 
separate  it  from  the  RED  equipment  as  well  as  other  BEACK  equipment.  Eollow  the  guidance  in  para¬ 
graph  4.5.,  modified  as  follows: 

4.8.2. 1.  Provide  a  separate  (third)  RED  distribution  facility,  RED  patch  panel,  and  RED  connec¬ 
tion  facilities  (e.g.,  distribution  frames). 

4. 8. 2. 2.  Shield  the  RED  and  BEACK  wires  associated  with  this  channel. 

4. 8. 2. 3.  Provide  a  separate  (third)  RED  signal  ground  as  required. 

4. 8. 2.4.  Connect  the  RED  cable  shields,  RED  signal  ground  on  the  cryptographic  equipment,  and 
the  potential  RED  equipment  associated  with  this  channel  to  the  third  RED  signal  ground. 

4.9.  Analyzing  the  Results.  Analyze  the  results  and  determine  if  they  are  acceptable  (i.e.,  reasonable, 
practical,  and  cost  effective).  If  the  results  are  not  acceptable,  request  assistance  from  your  MAJCOM  lA 
office.  If  the  results  are  acceptable,  continue. 

4.10.  Documenting  the  Results.  Document  the  results  that  identify  the  required  countermeasures  on  AE 
Eorm  4170,  Part  II,  following  the  instructions  in  Attachment  4  for  cryptographic  equipment.  Remember, 
the  form  establishes  EMSEC  requirements.  It  must  clearly  state  to  the  user  what  is  required.  It  is  not  an 
inspection  report. 

4.11.  Completing  the  Cryptographic  Equipment  Countermeasures  Review.  Complete  the  counter¬ 
measures  reviews  according  to  Chapter  5. 
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Chapter  5 

COMPLETING  THE  COUNTERMEASURES  REVIEWS 

5.1.  Introduction.  Completing  the  EMSEC  countermeasures  reviews  for  information  systems,  commu¬ 
nications  systems,  and  cryptographic  equipment  requires:  authenticating  and  validating  the  information 
systems,  communications  systems,  and  cryptographic  equipment  countermeasures  reviews;  applying  the 
countermeasures;  inspecting  the  system;  and  certifying  EMSEC  requirements  have  been  met.  All  this  is 
documented  on  AE  Eorm  4170.  If  the  countermeasures  reviews  are  made  by  a  person  other  than  the  one 
who  made  the  EMSEC  assessments,  use  a  new  AE  Eorm  4170  for  the  countermeasures  reviews.  Enter  the 
same  tracking  number  for  this  AE  Eorm  4170  for  the  countermeasures  reviews  as  was  used  for  the 
EMSEC  assessments.  Use  the  same  tracking  number  when  the  countermeasures  reviews  are  documented 
on  a  different  AE  Eorm  4170  than  the  assessments. 

5.2.  Classification  Marking.  If  required  by  another  classification  guide,  re-mark  the  completed  AE 
Eorm  4170  with  the  required  classification  marking  if  higher  than  CONEIDENTIAE.  Cross  out  the  clas¬ 
sification  authority  in  the  upper  right-hand  block  of  the  form  and  identify  the  classification  guide.  Enter 
the  declassify  date  in  the  upper  right  hand  box  which  is  10  years  (or  whatever  is  specified  in  the  classifi¬ 
cation  guide  requiring  a  higher  level  of  classification)  from  the  date  of  the  EMSEC  assessments  in  block 
6C.  As  a  minimum,  cross  out  or  mark  through  the  “When  Eilled  In”  part  of  the  classification  marking  at 
the  top  and  bottom,  front  and  back,  of  the  form. 

5.3.  Authentication  Documentation.  Type  or  print  the  name  of  the  lA  person,  organization,  and  office 
symbol  making  the  EMSEC  countermeasures  reviews  in  block  6A.  The  lA  person  signs  the  form  in  this 
block.  Signing  by  the  lA  person  establishes  EMSEC  requirements  the  user  must  adhere  to  according  to 
AEI 33-203.  When  a  CTTA  makes  the  EMSEC  countermeasures  reviews,  use  “CTTA”  as  the  organization 
and  office  symbol.  The  CTTA  signs  the  form  in  this  block  (see  Figure  A22.I.  for  an  example.) 

5.4.  Tracking  and  Address  Information.  To  avoid  unnecessary  costs  associated  with  mailing  classified 
documents,  CTTA  validation  will  be  made  by  separate,  unclassified  correspondence;  the  preferred 
medium  is  electronic  mail  (E-mail).  The  lA  office  completing  the  AE  Eorm  4170  completes  block  7  of  the 
form.  Enter  the  “Tracking  Number.”  This  number  has  three  parts:  MAJCOM,  base,  3-digit  number  (e.g., 
AECA-Scott-001).  The  3-digit  number  is  unique  for  each  EMSEC  assessment  and  countermeasures 
review  on  the  base.  Enter  the  lA  office’s  E-mail,  message,  or  mailing  address.  (See  Figure  A22.I.  for  an 
example.) 

5.5.  Validating  the  Countermeasures  Reviews.  A  CTTA  must  validate  all  countermeasures  reviews. 
Forward  all  countermeasures  reviews  to  HQ  AFCA/TCBA-CTTA. 

5.5.1.  SCI,  Special  Access  Required,  and  Special  Access  Programs.  Validate  all  countermeasures 
reviews  for  these  categories  of  information  before  applying  countermeasures;  this  is  a  must. 

5.5.2.  Shielding  or  TEMPEST-Certified  Equipment.  Validate  all  countermeasures  reviews  that  iden¬ 
tify  using  shielding  or  TEMPEST-certified  equipment  before  implementing  any  shielding  or  acquiring 
TEMPEST-certified  equipment;  this  is  a  must. 
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5.5.2. 1.  Justify  all  requirements  for  faeility  shielding,  shielded  enelosures,  equipment  eneapsula- 
tion,  or  TEMPEST-eertified  equipment.  Base  all  deeisions  to  use  shielding  or  TEMPEST-eertified 
equipment  on  the  results  of  either  a  eost  analysis  or  feasibility  study. 

5. 5. 2. 1.1.  The  eost  analysis  must  elearly  show  that  using  shielding  (faeility,  enelosure,  or 
encapsulation)  or  TEMPEST-eertified  equipment  is  less  expensive  than  applying  all  required 
countermeasures  identified  by  the  countermeasures  review. 

5. 5. 2. 1.2.  The  feasibility  study  must  show  that  the  available  inspectable  space  cannot  contain 
the  compromising  emanations,  the  user  cannot  extend  the  inspectable  space,  and  there  is  no 
other  equipment  available  with  an  acceptable  TEMPEST  profile  that  meets  operational  or  mis¬ 
sion  requirements. 

5. 5. 2. 1.3.  Both  the  cost  analysis  and  the  feasibility  study  must  show  the  chosen  option  is  the 
less  expensive. 

5. 5. 2. 2.  The  lA  office  sends  the  countermeasures  review,  with  the  justification,  to  the  MAJCOM 
lA  office. 

5. 5. 2. 3.  If  the  MAJCOM  lA  office  disagrees  with  the  countermeasures  review,  return  it  to  the  lA 
office  for  revision. 

5. 5. 2.4.  If  the  MAJCOM  lA  office  agrees  with  the  countermeasures  review,  indicate  concurrence 
and  send  it  to  HQ  AECA/TCBA-CTTA. 

5. 5. 2. 5.  If  the  CTTA  disagrees  with  the  countermeasures  review,  return  it  through  the  MAJCOM 
lA  office  to  the  lA  office  for  revision. 

5. 5. 2. 6.  If  the  CTTA  agrees  with  the  countermeasures  review,  validate  it  (see  Figure  A22.1.  for 
an  example  of  how  to  enter  the  CTTA  validation),  make  a  copy  of  the  AE  Eorm  4170,  file  the  copy 
and  supporting  documentation,  and  return  the  original  AE  Eorm  4170  through  the  MAJCOM  lA 
office  to  the  lA  office. 

5.5.3.  All  Other  Countermeasures  Reviews.  Validation  prior  to  the  application  of  countermeasures  is 
not  required  unless  the  total  cost  of  countermeasures  exceeds  $1,000.00.  If  countermeasure  costs  will 
exceed  $1,000.00,  validate  all  countermeasures  reviews  before  implementing  any  countermeasures; 
this  is  a  must. 

5.5.3. 1.  The  lA  office  sends  a  copy  of  the  countermeasures  review  to  HQ  AECA/TCBA  through 
or  to  the  MAJCOM  lA  office  if  the  MAJCOM  lA  office  requires  it. 

5. 5. 3. 2.  If  the  CTTA  disagrees  with  the  countermeasures  review,  return  it  to  the  lA  office  for  revi¬ 
sion  through  or  to  the  MAJCOM  lA  office  if  the  MAJCOM  lA  office  requires  it. 

5. 5. 3. 3.  If  the  CTTA  agrees  with  the  countermeasures  review,  validate  it  and  inform  the  lA  office. 
The  CTTA  files  the  countermeasures  review  and  supporting  documentation. 

5.6.  Inform  the  User.  The  lA  office  types  or  prints  the  name  of  the  user,  organization,  office  symbol, 
and  telephone  number  in  block  6B  (see  Figure  A22.1.).  Explain  to  the  user  the  required  countermeasures. 
Inform  the  user  of  the  limitations  on  moving  equipment.  Eor  example,  if  the  EMSEC  requirements  are  the 
same  for  anywhere  within  the  building  where  the  equipment  is  currently  installed,  then  the  user  may  move 
the  equipment  anywhere  within  the  building  but  must  maintain  the  countermeasures  identified  on  the  AE 
Eorm  4170.  The  user  signs  the  form  in  this  block.  Signing  by  the  user  is  acknowledgment  that  the  user  has 
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been  informed  of  EMSEC  requirements  and  understands  what  is  required.  Provide  the  user  a  memoran¬ 
dum  identifying  the  required  countermeasures.  Use  the  Tracking  Number  for  identification,  do  not  use  the 
information  in  AE  Eorm  4170,  blocks  1  and  2.  See  Attachment  15  for  an  example. 

5.7.  Date.  Type  or  print  the  date  of  the  EMSEC  countermeasures  review  in  block  6C. 

5.8.  Apply  the  Countermeasures.  The  user  applies  the  required  countermeasures  and  notifies  the  lA 
office. 

5.9.  Emission  Security  Inspection.  The  lA  office  must  make  an  EMSEC  inspection  prior  to  certifica¬ 
tion  or  recertification.  The  countermeasures  reviews  are  the  basis  for  the  EMSEC  inspection.  The  inspec¬ 
tion  is  to  make  sure  all  required  information  systems,  communications  systems,  cryptographic  equipment, 
and  lA  countermeasures  are  effectively  implemented  or  applied.  The  user  must  correct  all  deficiencies 
discovered  by  an  EMSEC  inspection  or  request  a  temporary  or  permanent  waiver.  When  all  deficiencies 
have  been  corrected  or  the  waiver  completed,  the  user  requests  a  re-inspection.  The  user  must  maintain 
the  countermeasures.  Document  the  results  of  the  inspection  in  a  standard  memorandum,  dated,  addressed 
to  the  user,  and  signed  by  the  chief  of  the  lA  office.  The  lA  office  files  a  copy  with  the  AE  Eorm  4170. 

5.10.  Waivers.  Attach  any  waivers  to  the  countermeasures  reviews. 

5.11.  Emission  Security  Certification.  After  the  EMSEC  inspection  determines  all  required  EMSEC 
and  lA  countermeasures  are  effectively  implemented  or  applied,  the  system  can  be  EMSEC  certified. 
Type  or  print  the  name  of  the  lA  person,  organization,  and  office  symbol  making  the  EMSEC  inspection 
in  block  9A.  The  lA  person  signs  the  form  in  block  9B.  Enter  the  date  in  block  9C.  Completing  block  9 
satisfies  the  EMSEC  portion  of  the  system  C&A  process  (see  Figure  A22.1.).  To  avoid  classifying  the 
C&A  package,  the  lA  office  issues  a  memorandum  to  the  user  stating  EMSEC  certification  is  met.  Refer 
to  the  tracking  number  and  identify  the  location  where  the  AE  Eorm  4170  is  filed  in  the  memorandum.  Do 
not  use  the  information  in  AE  Eorm  4170,  blocks  1  and  2.  See  Attachment  16  for  an  example  of  an 
EMSEC  certification  memorandum. 

5.12.  File  Copy.  The  lA  office  maintains  a  copy  of  the  AE  Eorm  4170  on  file  until  the  system  no  longer 
processes  classified  information.  Maintain  a  copy  of  the  EMSEC  requirements  memorandum  and  the 
EMSEC  certification  memorandum  with  the  AE  Eorm  4170.  Check  with  the  user  annually  and  verify  the 
information  in  blocks  1,  2,  and  3  is  still  valid.  When  you  make  and  document  a  new  EMSEC  countermea¬ 
sures  review,  destroy  the  previous  one.  Use  the  same  tracking  number. 

5.13.  Reassessments  and  Recertifications.  Reassessments  are  made  when  a  system  must  be  recertified 
(C&A  recertifications  are  required  at  least  every  three  years),  the  threat  changes,  or  the  classification  level 
of  the  classified  information  changes. 

5.13.1.  Make  the  EMSEC  countermeasures  reviews  again  (information  systems,  communications 
systems,  or  cryptographic  equipment,  as  required). 
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5.13.1.1.  If  there  are  no  ehanges,  annotate  the  original  AF  Form  4170  with  the  information 
required  in  block  6 A  (if  different,  otherwise  initial)  and  the  date. 

5.13.1.2.  If  there  are  significant  changes,  reaccomplish  the  AF  Form  4170  to  reflect  the  current 
requirements. 

5.13.2.  Follow  the  guidance  in  paragraphs  5.1.  through  5.12. 
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Chapter  6 

EMISSION  SECURITY  MAINTENANCE 

6.1.  Maintaining  Equipment  and  Countermeasures.  Properly  maintaining  equipment  and  EMSEC 
countermeasures  is  essential. 

6.2.  Maintenance  Requirements.  Air  Eorce  users: 

6.2.1.  Ensure  equipment  used  to  process  classified  information  is  afforded  adequate  physical  protec¬ 
tion  during  maintenance. 

6.2.2.  Ensure  equipment  is  maintained  properly  by  appropriately  cleared  and  qualified  maintainers. 

6.2.3.  Control  the  disposition  of  TEMPEST-certified  equipment  (see  paragraph  6.8.)  to  prevent  tech¬ 
nology  transfer. 

6.2.4.  Do  not  maintain  the  TEMPEST  integrity  of  TEMPEST-certified  equipment  when  there  is  no 
need. 

6.3.  Ensuring  the  Integrity  of  TEMPEST-Certified  Equipment.  When  TEMPEST-certified  equip¬ 
ment  listed  on  the  Preferred  Products  Eist,  Endorsed  TEMPEST  Products  Eist  (ETPE),  or  designed  and 
tested  to  meet  National  Security  Telecommunications  and  Information  Systems  Security  Advisory  Mem¬ 
orandum  (NSTISSAM)/TEMPEST  1-92,  (C)  Compromising  Emanations  Laboratory  Test  Requirements, 
Electromagnetics  (U),  Eevel  I  standards  is  justified,  maintain  the  TEMPEST  integrity.  When  maintenance 
is  performed  on  such  equipment  no  unauthorized  component  substitutions,  modifications,  or  alterations 
are  allowed.  Maintain  the  configuration  of  such  equipment  to  the  as-certified  condition.  When  TEM¬ 
PEST-certified  equipment  is  justified,  the  following  applies: 

6.3.1.  Procurement  Requirements.  In  the  specifications  portion  of  a  contract  for  TEMPEST-certified 
equipment,  include  the  following  items  for  delivery:  a  hardware  maintenance  manual,  a  maintenance 
instruction  course,  and  a  guarantee  of  the  critical  spare  parts  used  in  the  design  and  manufacture  of  the 
equipment  to  meet  NSTISS AM/TEMPEST  1-92,  Eevel  I  limits.  These  items  are  separate  line  items 
on  the  purchase  request  submitted  to  the  contracting  office.  Design  these  requirements  to  give  the  Air 
Eorce  the  most  flexibility  to  achieve  the  most  cost-effective  support  of  the  equipment  (e.g.,  the  choice 
of  using  the  equipment  manufacturer,  an  independent  contractor.  Air  Eorce,  Government  Services 
Administration,  etc.,  to  provide  qualified  maintainers). 

6.3. 1.1.  Hardware  Maintenance  Manual.  Require  the  contractor  to  deliver  a  hardware  mainte¬ 
nance  manual  for  the  product.  The  manual  must  contain  instructions  and  maintenance  aids  neces¬ 
sary  to  support  the  maintenance  of  each  critical  compromising  emanation  suppression  feature  of 
the  product.  Examples  of  maintenance  aids  are  troubleshooting  charts,  schematic  diagrams,  wiring 
diagrams,  and  illustrations.  Classify  this  manual  as  necessary  according  to  AEMAN  33-272,  (S) 
Classifying  Communications  Security,  TEMPEST,  and  C4  Systems  Security  Research  and  Devel¬ 
opment  Information  (U). 

6. 3. 1.2.  Maintenance  Course.  Require  the  contractor  to  deliver  a  course  such  that  each  trainee 
knows  the  unique  restrictions  or  precautions  necessary  to  maintain  the  TEMPEST  integrity  of  the 
product  and  are  provided  access  to  and  are  instructed  in  the  use  of  the  maintenance  manual.  The 
acquiring  agency  determines  the  place,  time,  and  method  for  instruction. 
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6. 3. 1.3.  Critical  Spare  Parts.  Require  the  contractor  to  guarantee  the  production  and  supply  of 
critical  spare  parts  for  the  life  of  the  equipment.  Where  source  suppression  techniques  are  used,  it 
is  essential  that  the  contractor  guarantee  the  availability  and  integrity  of  those  critical  spare  parts 
where  the  substitution  of  similar  parts  may  negate  the  TEMPEST  integrity  of  the  product. 

6.3.2.  Technician  Qualifications.  To  maintain  TEMPEST-certified  equipment,  maintainers  must  meet 
certain  requirements. 

6.3.2. 1.  Clearance.  Maintainers  must  have  a  U.S.  SECRET  or  equivalent  clearance  to  maintain 
TEMPEST-certified  equipment.  In  instances  where  TOP  SECRET  or  Special  Category  (SPECAT) 
information  is  processed,  consider  a  higher  clearance.  If  access  to  classified  information  is 
required,  must  receive  a  favorable  National  Agency  Check  (see  AEI  31-501,  Personnel  Security 
Program  Management). 

6. 3. 2. 2.  Knowledge.  Know  the  specific  suppression  countermeasures  incorporated  into  the  design 
and  manufacture  of  the  particular  piece  of  TEMPEST-certified  equipment.  Since  this  knowledge 
will  come  from  instruction  on  maintaining  the  equipment,  document  when  the  instruction  is 
received. 

6.3.3.  Technician  Authorization. 

6.3.3. 1.  U.S.  military  and  civil  service  maintainers  are  authorized  by  the  base  communications 
and  information  systems  officer  (CSO),  chief  of  maintenance,  or  chief  of  mission  systems  flight, 
to  maintain  TEMPEST-certified  equipment  when  they  meet  the  requirements  identified  in  para¬ 
graph  6.3.2. 

6. 3. 3. 2.  Contractor  maintainers  are  authorized  by  the  contracting  officer  to  maintain  TEM¬ 
PEST-certified  equipment  when  they  meet  the  requirements  identified  in  paragraph  6.3.2. 

6.4.  When  Not  to  Maintain  the  TEMPEST  Integrity.  There  are  situations  where  the  use  of  TEM¬ 
PEST-certified  equipment  is  no  longer  needed  to  meet  control  of  compromising  emanations  requirements. 
This  occurs  because  the  TEMPEST-certified  equipment  was  obtained  to  satisfy  control  of  compromising 
emanations  requirements  based  on  older,  more  stringent  requirements  or  a  new  control  of  compromising 
emanations  assessment  or  countermeasures  review  determines  less  control  of  compromising  emanations 
is  required. 

6.4.1.  When  a  user  determines  that  maintaining  the  TEMPEST  integrity  of  TEMPEST-certified 
equipment  is  no  longer  required,  the  user  can  achieve  significant  cost  savings.  Maintaining  the  critical 
features  designed  into  the  TEMPEST-certified  equipment  is  not  required.  Certain,  usually  expensive, 
replaceable  parts,  such  as  the  drive  mechanism  for  removable  hard  drives,  are  not  required.  Qualified 
maintainers  are  not  required. 

6.4.2.  If  the  use  of  TEMPEST-certified  equipment  is  no  longer  justified,  take  one  of  two  options: 

6.4.2. 1.  Option  1.  If  possible,  use  the  TEMPEST-certified  equipment  to  satisfy  other  justified 
requirements  for  TEMPEST-certified  equipment.  In  most  cases,  this  procedure  is  limited  to 
exchanging  or  transferring  equipment  to  users  on  the  same  installation. 

6.4. 2. 2.  Option  2.  Stop  maintaining  the  TEMPEST  integrity  of  the  equipment. 

6.4.3.  Decertify  the  equipment  as  TEMPEST  certified  once  the  equipment  is  repaired  by  either 
replacing  a  critical  part  with  a  non-TEMPEST  part  or  when  a  maintainer  not  authorized  to  maintain 
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TEMPEST-certified  equipment  performs  maintenance.  The  CSO  authorizes  the  decertification  of 
TEMPEST-certified  equipment  on  a  case-by-case  basis. 

6.4.4.  When  the  equipment  is  decertified,  the  equipment  and  the  equipment  records  must  clearly  indi¬ 
cate  that  this  equipment  is  no  longer  TEMPEST  certified  as  of  that  date. 

NOTE:  One  method  for  marking  the  equipment  is  to  attach  a  label  near  the  automated  data  processing 
equipment  identification  label  and  an  entry  in  the  equipment  record  that  says:  EQUIPMENT  NO 

EONGER  TEMPEST  CERTIEIED.  DATE: _ ,  followed  by  the  name  of  the  decertifying  official, 

signature,  organization,  and  office  symbol. 

6.5.  Transportation  of  Equipment  for  Maintenance.  When  classified  information  processing  equip¬ 
ment  is  removed  from  its  operating  location  for  maintenance  or  repair  purposes,  ensure  compliance  with 
the  safeguarding  and  transportation  requirements  of  DoD  5200. 1-R.  Additionally: 

6.5.1.  Purge  the  equipment  of  all  stored  classified  information,  whenever  possible,  before  removing 
the  equipment  from  its  operating  location.  See  AESSI  5020,  Remanence  Security  (will  become 
AEMAN  33-224).  If  the  user  cannot  purge  the  equipment,  treat  the  equipment  as  a  classified  item  dur¬ 
ing  transportation  and  repair. 

6.5.2.  Maintain  a  record  of  the  day  and  time  of  the  removal  of  the  item  from  its  operating  location,  its 
arrival  at  the  repair  facility,  when  the  item  is  picked  up  from  the  repair  facility,  and  when  it  is  returned 
to  its  operating  location.  Keep  the  record  for  one  year. 

6.6.  Repair  Facilities.  Repair  facilities  are  accredited  to  the  highest  level  of  classified  information 
stored  within  them. 

6.7.  Emission  Security  Documentation-of-Maintenance  Requirements.  Maintain  a  log  that  identifies 
the  equipment,  the  serial  number  of  the  equipment,  the  day  and  time  of  arrival  at  the  repair  facility,  when 
repair  was  started,  the  person  making  the  repair,  when  the  repair  was  completed,  and  when  the  equipment 
was  released  from  the  repair  facility. 

6.8.  Disposing  of  TEMPEST-Certified  Equipment. 

6.8.1.  Protect  the  suppression  technology  used  in  TEMPEST-certified  equipment  and  formerly  TEM¬ 
PEST-certified  equipment  from  general  distribution  to  prevent  technology  transfer  by  controlling  its 
disposition. 

6.8.2.  Ensure  disposition  or  resale  is  consistent  with  established  export  control  and  technology  trans¬ 
fer  requirements.  Since  these  requirements  are  subject  to  change,  direct  questions  to  your  MAJCOM 
lA  office  or  HQ  AECA/TCBA-CTTA. 
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Chapter  7 

EMISSION  SECURITY  TESTING 

7.1.  Purpose  of  Testing.  The  purpose  of  EMSEC  testing  is  to: 

7. EE  Discover  EMSEC  Hazards.  To  process  classified  information  safely,  eliminate  EMSEC  haz¬ 
ards.  Testing  determines  the  extent  and  nature  of  compromising  emanations. 

7.1.2.  Identify  Equipment  Vulnerabilities.  Identifying  the  specific  vulnerabilities  of  equipment  allows 
for  an  informed  selection  of  the  best  method  of  protection  such  as  equipment  modifications,  installa¬ 
tion  changes,  additional  countermeasures,  changes  in  operating  procedures,  or  increasing  physical 
security. 

7.1.3.  Determine  Safe  Eimits  for  Eacilities.  Knowing  the  safe  limits  of  a  facility  permits  the  EMSEC 
manager  to  select  only  the  countermeasures  needed. 

7.2.  Kinds  of  Emission  Security  Tests.  There  are  four  kinds  of  EMSEC  tests: 

7.2.1.  Eacility  Tests.  Eacility  tests  are  conducted  to  determine  if  compromising  emanations  are  detect¬ 
able  beyond  the  inspectable  space  for  a  facility.  These  tests  determine  the  profile  of  a  facility  and  the 
results  are  valid  so  long  as  no  changes  are  made  in  the  physical  arrangements  of  the  facility  or  the 
equipment  in  the  facility. 

7.2.2.  Zone  Tests.  Zone  tests  are  conducted  in  two  parts.  One  part  tests  a  facility  to  determine  the 
amount  of  free  space  attenuation  (zone)  offered  by  the  facility.  The  other  part  tests  the  equipment  in  a 
laboratory  environment  to  determine  the  range  (zone)  of  compromising  emanations  from  the  equip¬ 
ment. 

7.2.3.  Aircraft  Tests.  Aircraft  are  tested  primarily  for  communications  systems  and  cryptographic 
equipment. 

7.2.4.  Eaboratory  Tests.  Eaboratory  (shielded  enclosure)  tests  determine  the  exact  nature  of  all  com¬ 
promising  emanations  produced  by  equipment.  Results  of  laboratory  tests  are  generally  applied  to  all 
applications  of  the  equipment  without  regard  to  the  specific  facility. 

7.3.  When  to  Test. 

7.3.1.  Request  a  test  when  one  of  the  following  conditions  exists: 

7. 3. 1.1.  A  technical  intercept  action  against  the  facility  is  probable. 

7.3. 1.2.  When  classified  information  is  processed  on  aircraft.  All  specialized  aircraft  configura¬ 
tions  are  tested.  Other  aircraft  are  tested  randomly  when  requested  by  HQ  USAE  or  a  MAJCOM. 

7.3.2.  Consider  requesting  a  test  when  one  of  the  following  conditions  exists  where  EMSEC  is 
required: 

7.3.2. 1.  A  significant  difference  between  the  equipment’s  published  TEMPEST  zone  or  TEM¬ 
PEST  profile  and  the  facility  zone  or  inspectable  space. 

1 3.22.  If  the  installation  is  new. 
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7. 3. 2. 3.  The  equipment  does  not  meet  the  established  EMSEC  installation  requirements  for  the 
facility  because  of  space  limitations,  environmental,  or  operational  use  (such  as  mobile  vans  and 
aircraft).  This  condition  applies  only  when  processing  TOP  SECRET  information  in  the  United 
States,  and  when  SECRET  or  higher  information  is  processed  outside  the  United  States. 

7. 3. 2. 4.  Sufficient  TEMPEST  profile  data  on  the  equipment  is  not  available  and  TOP  SECRET 
information  is  processed  in  a  facility  within  the  United  States,  or  SECRET  or  higher  information 
is  processed  outside  the  United  States. 

13.2.5.  When  using  the  zoning  method  to  contain  compromising  emanations  within  the  inspect- 
able  space. 

7.3.3.  Classify  the  condition  listed  in  paragraph  7.3.1. 1.  SECRET  when  used  as  justification.  Classify 
the  conditions  listed  in  paragraphs  7.3.2.I.  or  7.3.2.3.  CONEIDENTIAE  when  used  as  justification  for 
a  test  request. 

7.4.  Requesting  a  Test.  The  wing  lA  office  and  the  user  consult  on  the  need  for  a  test.  If  a  test  is  needed, 
the  wing  lA  office  prepares  the  request  and  the  user  provides  the  wing  lA  office  the  necessary  information 
(see  Attachment  17).  If  the  user  desires  a  test,  the  user  prepares  the  request  and  forwards  it  to  the  wing  lA 
office.  The  wing  lA  office  forwards  the  request  through  the  MAJCOM  lA  office  or  SPECAT  EMSEC 
manager  to  HQ  AECA/TCBA-CTTA. 

7.5.  Emission  Security  Test  Results.  The  results  of  an  EMSEC  test  take  precedence  over  all  other  guid¬ 
ance.  Correct  hazards  or  complete  a  temporary  or  permanent  waiver  (see  AEI  33-203)  before  processing 
classified  information. 
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Chapter  8 

EMISSION  SECURITY  COUNTERMEASURES 

8.1.  Introduction.  The  various  EMSEC  countermeasures  used  to  prevent  or  reduce  the  opportunity  for 
an  adversary  to  detect  compromising  emanations  and  gain  intelligence  information  are  discussed  in  this 
chapter.  The  countermeasures  for  communications  systems  and  cryptographic  equipment  are  also 
included  since  they  are  essentially  the  same.  Here,  for  each  countermeasure,  an  attempt  is  made  to  explain 
what  the  vulnerability  is,  what  the  countermeasure  is  for  that  vulnerability,  what  the  countermeasure  does, 
the  reasons  or  conditions  that  would  negate  the  need  for  the  countermeasure,  some  information  on  how  to 
apply  the  countermeasure,  and  alternatives  to  the  countermeasure. 

8.2.  Fundamentals  of  Compromising  Emanations.  Selecting  and  applying  countermeasures  are  deter¬ 
mined  by  the  EMSEC  countermeasures  review  and  the  selection  will  vary  depending  on  the  amount  of 
inspectable  space,  the  EMSEC  characteristics  of  the  equipment  used  to  process  classified  information, 
separation  distances,  and  the  level  of  physical  security.  One  of  the  more  difficult  things  to  do  in  EMSEC 
is  to  select  countermeasures.  Eor  the  control  of  compromising  emanations.  Attachment  6  through 
Attachment  14  contain  listings  of  countermeasures  to  review,  dependent  on  the  environment  where  clas¬ 
sified  information  is  processed.  In  the  case  of  required  countermeasures,  the  person  making  the  counter¬ 
measures  review  is  asked  to  look  for  a  reason  not  to  apply  a  required  countermeasure.  In  the  case  of 
countermeasures  to  consider  applying,  the  person  making  the  countermeasures  review  is  asked  to  deter¬ 
mine  when  a  nonrequired  countermeasure  is  needed  and  the  reason  why  it  is  needed.  Therefore,  in  order 
to  make  these  decisions,  the  person  making  the  control  of  compromising  emanations  countermeasures 
review  needs  to  know  something  about  electronics,  electromagnetic  (radio)  waves,  antennas,  and  how 
compromising  emanations  are  generated. 

8.2.1.  Circuit  Theory.  An  understanding  of  where  compromising  emanations  come  from  involves  a 
simple  understanding  of  basic  circuit  theory.  In  basic  circuit  theory,  there  is  a  source,  a  path,  and  a 
load.  Basic  circuit  theory  can  be  seen  in  simple  terms  as  a  battery  (source),  a  pair  of  wires  (path),  and 
a  light  bulb  (load).  When  properly  connected  together,  current  flows  from  the  battery,  through  one 
wire  to  the  light  bulb,  through  the  light  bulb  (which  does  what  we  want,  gives  off  light),  and  returns  to 
the  battery  by  the  second  wire.  If  we  disconnect  the  battery,  break  one  of  the  wires,  or  remove  the  light 
bulb,  current  ceases  to  flow  and  there  is  no  “signal.”  This  basic  function  of  current  flow  in  a  circuit  is 
used  in  all  electronic  equipment. 

8.2.2.  Integrated  Circuits.  Nearly  all  electronic  equipment  today  uses  integrated  circuits.  The  ampli¬ 
fier  is  the  basic  component  of  the  integrated  circuit.  The  amplifier  consists  of  a  junction  and  various 
resistances  to  make  the  junction  perform  as  desired.  When  an  energy  source  is  applied  across  the  junc¬ 
tion,  the  amplifier  is  turned  on  and  off  by  an  input  signal.  The  output,  since  this  is  an  amplifier,  is  a 
larger  version  of  the  input  signal.  Adjustments  are  made  to  the  circuit  design  to  change  its  amplifica¬ 
tion  to  make  it  do  different  things. 

8.2.3.  Circuit  Energy.  Every  circuit  uses  more  energy  than  is  needed  to  process  the  intended  signal. 
There  are  several  reasons  for  this. 

8.2.3. 1.  When  current  flows  through  a  circuit,  the  electrons  making  up  the  current  flow  meet 
“resistance”  and  they  run  into  protons,  neutrons,  etc.  Overcoming  this  “resistance”  takes  extra 
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energy,  some  of  which  is  given  off  as  heat.  Most  of  the  extra  energy  is  radiated  from  the  circuit  and 
is  known  as  “noise”;  random  pieces  of  energy  of  different  magnitudes,  duration,  and  frequency. 

8. 2. 3. 2.  The  main  source  of  compromising  emanations  is  a  result  of  nature.  If  you  look  closely  at 
the  natural  world  around  you,  you  will  not  find  straight  lines.  Nature  does  not  support  straight 
lines;  it  likes  rounded  things  and  it  likes  curves.  Sound  is  curves;  scientifically  called  “sine 
waves”.  Sunlight  is  curves;  more  sine  waves  but  a  lot  higher  in  frequency  than  sound.  These  sine 
waves  can  be  represented  easily  by  mathematical  formulas. 

8. 2. 3. 3.  Humans,  however,  attempt  to  defy  nature  and  make  computers  that  use  square  waves 
known  as  “digital  signals”.  These  do  not  occur  in  nature.  They  cannot  be  represented  by  a  mathe¬ 
matical  formula.  When  the  digital  signal  goes  from  one  level  to  another,  there  is  a  discontinuity. 
Mathematically,  the  digital  signal  could  be  presented  by  one  formula  like  x  =  0  for  one  level  and 
another  formula  like  x  =  5  for  the  other;  however,  there  is  no  one  formula  that  represents  both  lev¬ 
els  and  the  jump  between  levels;  hence  the  discontinuity.  Sometimes,  scientists  mathematically 
represent  square  waves  by  some  fundamental  sine  wave  formula  plus  all  the  odd  harmonics  to 
infinity.  This  formula  is  hard  to  use  since  it  would  take  forever  to  make  a  calculation.  Practically 
speaking,  engineers  and  mathematicians  use  only  a  few  of  the  first  harmonics  to  design  equip¬ 
ment. 

8. 2. 3.4.  So,  when  a  digital  computer  is  made  to  change  state,  that  is,  go  from  one  level  to  another, 
it  takes  more  energy  to  do  that  to  overcome  the  resistance  and  the  discontinuity.  That  extra  energy 
does  not  go  into  the  intended  signal  itself  but  it  has  to  go  somewhere.  Some  of  it  is  given  off  as 
heat.  Some  of  it  is  given  off  in  random  bursts.  However,  most  of  it  is  radiated  from  the  cir- 
cuit--called  “noise”.  This  noise  is  organized.  Since  it  only  occurs  when  there  is  a  transition 
between  levels,  it  can  be  related  to  the  intended  signal.  When  related,  it  is  called  a  “compromising 
emanation”.  When  this  energy  is  radiated  from  the  circuit,  it  looks  and  acts  just  like  a  radio  signal. 

8. 2. 3. 5.  There  are  a  number  of  things  that  affect  the  magnitude  of  the  radiated  compromising 
emanations.  One  of  the  two  prime  things  is  the  difference  in  the  two  levels.  The  greater  the  differ¬ 
ence,  the  more  energy  it  takes  to  make  the  jump  and  the  bigger  the  emanation.  The  other  prime 
thing  is  the  time  it  takes  to  get  from  one  level  to  the  other.  The  shorter  the  time,  the  more  energy  it 
takes  to  get  there  and  the  bigger  the  compromising  emanation.  Because  of  these  two  factors,  com¬ 
promising  emanations  are  two,  ten,  a  hundred,  sometimes  a  thousand  times  greater  than  the 
intended  signal.  Additionally,  there  are  a  number  of  other  things  that  affect  not  only  the  magnitude 
but  even  if  they  will  occur;  these  are  impurities  in  the  circuit,  temperature,  humidity,  etc. 

8.2.4.  Circuit  Wiring.  This  is  another  source  of  compromising  emanations  but  appears  in  a  different 
form  than  those  caused  by  the  basic  circuit.  In  a  wire,  when  a  current  is  caused  to  flow  through  it,  a 
magnetic  field  is  generated  around  the  wire.  This  property  is  used  in  generators  to  change  motion 
energy  (for  instance,  falling  water)  into  electricity  and  is  used  in  motors  to  change  electricity  into 
motion.  This  property  is  not  a  problem  as  long  as  the  current  stays  steady;  the  magnetic  field  builds  up 
and  remains  constant.  When  the  current  is  made  to  vary,  then  the  magnetic  field  changes  as  the  current 
changes  When  the  wire  is  the  right  length,  it  acts  like  an  antenna  and  radiates  an  electromagnetic 
field..  Since  the  magnetic  field  is  varying  as  the  intended  signal  is  varying,  it  is  easy  to  relate  the  two 
and  this  becomes  a  compromising  emanation.  The  compromising  emanations  radiated  from  a  wire  are 
not  as  strong  as  the  compromising  emanations  radiated  from  the  circuit  so  they  won’t  go  as  far  but 
they  are  more  constant;  that  is,  they  are  always  there  and  at  the  same  relative  strength. 
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8.3.  Requirement  -  Contain  Compromising  Emanations.  When  it  is  required  to  eontrol  eompromis- 
ing  emanations,  eontain  them  within  the  inspectable  space.  Compromising  emanations  are  classed  as 
either  radiated  or  conducted  based  on  the  escape  medium. 

8.4.  Containing  Radiated  Compromising  Emanations.  There  are  a  number  of  ways  available  to  con¬ 
tain  radiated  compromising  emanations  within  the  inspectable  space.  Base  the  decision  on  which  method 
to  use  on  cost  and  practicality. 

8.4.1.  Profile  Matching.  Match  the  emission  profile  of  the  equipment  to  the  inspectable  space.  This  is 
the  most  direct  way  to  meet  the  requirement  to  contain  compromising  emanations  within  the  inspect¬ 
able  space.  Unfortunately,  an  EMSEC  test  is  required  to  establish  a  profile,  the  ERTZ.  This  can  be 
costly  and  is  not  timely.  Contain  the  ERTZ  within  the  inspectable  space  by  either  expanding  the 
inspectable  space  or  selecting  equipment  with  smaller  ERTZs. 

8.4.2.  Zoning.  This  method  requires  two  different  tests;  the  facility  and  the  equipment.  Once  the  facil¬ 
ity  and  the  equipment  are  zoned,  match  zone  ratings.  Zone  testing  will:  quantify  the  facility’s  attenua¬ 
tion  characteristics  and  assign  a  zone  rating;  and  measure  the  magnitude  of  the  compromising 
emanations  from  the  equipment  and  assign  a  zone  rating.  The  cost  to  zone  a  facility  is  based  on  the 
temporary  duty  costs  for  a  team  of  three;  travel  time  plus  1  to  1-1/2  days  per  building.  The  cost  to  zone 
test  equipment  is  mostly  in  the  cost  of  shipping  the  equipment  to  the  test  laboratory.  It  takes  l-to-2 
days  to  zone  test  a  PC. 

8.4.3.  Eacility  Testing.  Testing  the  facility  is  one  of  the  best  ways  to  ensure  compromising  emanations 
are  contained  within  the  inspectable  space.  However,  this  method  is  costly.  The  costs  depend  on  the 
number  of  equipment  items  tested,  which  affects  the  length  of  stay  of  the  test  team.  The  Air  Eorce 
CTTA  determines  if  a  request  for  a  facility  test  will  be  tasked  to  the  EMSEC  test  team. 

8.4.4.  TEMPEST-Certified  Equipment.  Using  TEMPEST-certified  equipment  is  a  very  good  way  to 
ensure  compromising  emanations  are  contained  within  the  inspectable  space.  The  cost  of  TEM¬ 
PEST-certified  equipment  is  usually  2-to-5  times  the  cost  of  off-the-shelf,  non-TEMPEST-certified 
equipment.  Because  this  method  is  very  expensive,  its  use  must  be  justified  according  to  paragraph 
5.5.2.  and  validated  by  a  CTTA.  TEMPEST-certified  equipment  is  applied  mainly  in  hostile  environ¬ 
ments  where  it  is  known  an  adversary  exploits  compromising  emanations.  Sometimes  it  is  necessary 
to  employ  TEMPEST-certified  equipment  in  other  environments  considered  less  hostile  but  where 
U.S.  Government  control  is  extremely  limited. 

8.4.5.  Shielding.  Shielding  the  equipment,  room,  or  facility  is  an  excellent  way  to  contain  compro¬ 
mising  emanations  within  the  inspectable  space.  Because  this  method  is  very  expensive,  its  use  must 
be  justified  according  to  paragraph  5.5.2.  and  validated  by  a  CTTA.  Consider  shielding  in  hostile  envi¬ 
ronments  where  it  is  known  compromising  emanations  are  exploited.  Also,  consider  using  shielding 
in  other,  less  hostile  environments  where  U.S.  Government  control  is  extremely  limited.  Shielding  is 
applied  directly  to  equipment  (encapsulation),  rooms  (shielded  enclosure),  or  facilities  (global).  There 
are  two  standards  for  shielding  effectiveness:  (1)  The  Air  Eorce  standard  for  shielding  effectiveness 
(attenuation)  for  shielded  enclosures  and  global  shielding  is  50  dB  (plus  an  initial  10-dB  allowance  for 
life-time  degradation).  Do  not  install  cryptographic  equipment  or  radio  equipment  in  a  shielded  enclo¬ 
sure.  (2)  The  standard  for  equipment  is  NSTISSAM/TEMPEST  1-92,  Eevel  I. 

8.5.  Containing  Conducted  Compromising  Emanations.  Evaluating  all  conductive  paths  for  the 
escape  of  compromising  emanations  is  a  difficult  task  because  there  are  so  many.  The  evaluator  knows  to 


AFMAN33-214V2  21  SEPTMEBER  2001 


37 


look  for  the  obvious  paths  like  telephone  lines  and  other  signal  lines.  Additional,  less  obvious,  paths  are 
the  power  lines  (and  the  electrical  metallic  tubing  [emt]  they  run  in),  extension  cords,  signal  ground  wires, 
alarm  signal  lines,  fire  suppression  piping,  air  conditioning  and  heating  ducts,  water  pipes,  building 
metallic  members,  etc.  Treat  each  as  specified  in  the  applicable  countermeasures  review  attachment, 
depending  on  a  number  of  factors  like  the  threat  level,  sensitivity  of  the  information,  location  of  the  facil¬ 
ity  on  the  base  relative  to  the  boundary  of  the  inspectable  space,  etc. 

8.6.  RED  and  BLACK  Concept.  The  RED  and  BLACK  concept,  by  definition,  establishes  areas  for 
the  placement  of  equipment  processing  classified  information  (RED)  that  are  separate  and  unique  from 
the  areas  for  equipment  processing  unclassified  information  (BLACK).  The  concept  has  two  parts: 

8.6.1.  Physical  Separation.  All  equipment,  wire  lines,  components,  and  systems  that  process  classi¬ 
fied  information  are  considered  RED.  All  equipment,  wire  lines,  components,  and  systems  that  pro¬ 
cess  encrypted  classified  information  or  unclassified  information  are  considered  BLACK.  The  RED 
and  BLACK  concept  is  to  establish  minimum  guidance  for  physical  separation  to  decrease  the  proba¬ 
bility  that  electromagnetic  emissions  from  RED  devices  will  couple  to  BLACK  systems. 

8.6.2.  Electrical  Separation.  Electrical  separation  ensures  that  every  signal  conductor  from  a  RED 
device  is  routed  to  another  RED  device,  or  is  encrypted  before  connection  to  a  BLACK  device.  Elec¬ 
trical  separation  addresses  signal  distribution,  power  distribution,  and  grounding.  Switches  and  other 
devices  used  to  interface  between  RED  and  BLACK  circuits  and  equipment  should  exhibit  the  follow¬ 
ing  port-to-port  isolation  characteristics: 

8.6.2. 1.  100  dB  over  the  baseband  audio  frequency  range  between  0.3  and  15  kilohertz. 

8. 6. 2. 2.  80  dB  over  the  baseband  video  frequency  range  of  O-to-5  megahertz  (MHz). 

8. 6. 2. 3.  60  dB  over  the  frequency  range  from  1  times  the  basic  data  rate  to  10  times  the  basic  data 

rate  of  the  digital  signals  processed. 

8.7.  RED  and  BLACK  Equipment.  RED  equipment  processes  clear-text,  classified  information. 
BLACK  equipment  processes  encrypted  or  unclassified  information.  Designating  equipment  as  RED  or 
BLACK  further  ensures  the  physical  and  electrical  separation  requirement.  Every  RED  equipment  is  con¬ 
nected  only  to  another  RED  equipment  or  the  output  is  encrypted  prior  to  connection  to  a  BLACK  equip¬ 
ment.  Equipment  is  comprised  of  machines  which  process  information  in  electronic,  electrical,  or 
electromechanical  form.  As  information  is  processed,  current  flows  in  wires  and  traces  in  the  equipment, 
electronic  circuits  change  state,  switches  open  and  close,  solenoids  are  energized  and  de-energized, 
images  are  created  on  screens  with  electron  streams,  and  many  other  similar  actions  occur.  When  these 
actions  take  place,  emanations,  as  discussed  in  paragraph  8.2.,  are  generated.  Normally,  these  emanations 
are  seen  as  noise  and  are  a  nuisance  that  is  tolerated  or  reduced  to  a  tolerable  level.  These  emanations  pass 
through  the  atmosphere  just  like  radio  and  television  (TV)  broadcast  signals,  and  someone  can  detect  and 
analyze  them  to  reveal  the  information  being  processed.  If  classified  information  is  processed,  then  these 
are  compromising  emanations. 

8.8.  Countermeasure  --  RED  Equipment  and  BLACK  Equipment  Separation. 

8.8.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  in  RED  equipment  as  a  result  of 
state  changes  in  electronic  circuits  and  current  flow  in  traces  and  wires.  The  wires,  traces,  frame,  and 
cover  of  BLACK  equipment  can  act  as  receiving  antennas  and  pick  up  compromising  emanations 
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radiated  from  nearby  RED  equipment.  The  problem  is  if  eompromising  emanations  are  pieked  up  by 
BLACK  equipment,  they  ean  eseape  on  BLACK  wire  lines  connected  to  the  BLACK  equipment  and 
on  the  BLACK  power  cord  connected  to  the  BLACK  equipment. 

8.8.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  equipment  from  BLACK 
equipment. 

8.8.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BLACK  equipment 
picking  up  compromising  emanations  from  RED  equipment  and  escaping  the  inspectable  space  on 
BLACK  wire  lines  connected  to  BLACK  equipment  and  BLACK  power  lines. 

8.8.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BLACK  wire  lines  and  BLACK  power  lines,  are  controlled.  Normally,  this  counter¬ 
measure  is  not  needed  if: 

8.8.4. 1.  The  line  distance  of  BLACK  wire  lines  connected  to  BLACK  equipment  from  the  build¬ 
ing  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000 
meters  or  the  BLACK  lines  are  fiber  optic,  or, 

8. 8. 4. 2.  A  BLACK  line  isolation  countermeasure  is  used,  and, 

8. 8. 4. 3.  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 

8.8.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  equipment  away  from  the  BLACK  equip¬ 
ment  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment.  Traditionally, 
under  ideal  conditions,  areas  were  established  in  a  facility  for  the  placement  of  RED  equipment  sepa¬ 
rate  and  unique  from  areas  with  BLACK  equipment.  When  this  was  done,  two  areas  were  created:  a 
RED  equipment  area  and  a  BLACK  equipment  area.  A  RED  equipment  area  is  the  space  within  a  con¬ 
trolled  access  area  (CAA)  where  RED  information  processing  equipment  and  associated  power,  sig¬ 
nal,  control,  ground,  and  signal  distribution  facilities  are  installed.  A  BLACK  equipment  area  is  an 
area  in  a  CAA  area  where  equipment  processing  unclassified  information  or  encrypted  classified 
information  and  associated  power,  signal,  control,  ground,  and  distribution  facilities  are  installed. 
However,  today,  most  classified  information  is  processed  in  an  office  environment.  Often,  this  envi¬ 
ronment  does  not  lend  itself  to  establishing  RED  equipment  areas  and  BLACK  equipment  areas  eas¬ 
ily.  However,  achieving  and  maintaining  the  separation  of  RED  and  BLACK  equipment  may  be 
required.  If  an  EMSEC  test  determines  that  a  hazard  exists,  a  countermeasure  to  consider  is  to  increase 
the  physical  separation  distance.  A  further  problem  is  offices  are  rearranged  from  time  to  time  that  can 
lead  to  a  natural  laxness  where  the  separation  requirements  are  forgotten. 

8.8.6.  Alternatives.  The  alternatives  to  fully  separating  RED  equipment  from  BLACK  equipment,  as 
required  in  the  applicable  countermeasures  review  attachment,  are: 

8.8.6. 1 .  Use  a  BLACK  wire  line  isolation  countermeasure.  This  reduces  the  separation  distance  to 
15  percent  of  the  required  distance  (minimum  15  centimeters),  or, 

8. 8. 6. 2.  Specially  orienting  RED  equipment  to  BLACK  equipment.  This  alternative  requires  ori¬ 
enting  the  RED  equipment  so  the  internal  wiring  and  traces  are  not  parallel  to  the  BLACK  equip¬ 
ment  internal  wiring  and  traces.  Most  internal  wiring  and  circuit  boards  (and  by  extension,  the 
traces)  may  act  as  antennas.  These  wires  and  traces  usually  run  parallel  to  the  edges  of  the  equip¬ 
ment.  Lirst  determine  the  orientation  of  the  longest  runs;  up-and-down,  side-to-side,  or 
front-to-back,  on  both  the  RED  equipment  and  the  BLACK  equipment.  If  the  traces  are  not  in  the 
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same  plane  (one  is  up-and-down,  the  other  is  side-to-side),  then,  the  separation  distance  is  reduced 
by  50  percent  (minimum  15  centimeters).  If  the  traces  are  parallel,  then,  orient  the  RED  equipment 
at  a  45-degree  angle  to  BLACK  equipment.  The  separation  distance  is  reduced  by  50  percent 
(minimum  15  centimeters)  with  such  orientation,  or, 

8. 8. 6. 3.  Use  TEMPEST-certified  equipment.  This  reduces  the  separation  distance  to  5  centime¬ 
ters,  or, 

8. 8. 6. 4.  Shield  the  equipment  to  reduce  compromising  emanations  by  using  the  encapsulation 
technique.  This  reduces  the  separation  distance  to  5  percent  of  the  required  distance  (minimum  5 
centimeters).  If  there  are  several  items  of  RED  equipment  that  need  separation  from  several  items 
of  BLACK  equipment,  an  alternative  to  consider  is  using  a  shielded  enclosure. 

8.9.  Countermeasure  --  RED  Equipment  and  BLACK  Wire  Line  Separation. 

8.9.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  in  RED  equipment  as  a  result  of 
state  changes  in  electronic  circuits  and  current  flow  in  traces  and  wires.  The  problem  is  BLACK  wire 
lines  can  act  as  receiving  antennas  and  pick  up  compromising  emanations  radiated  from  nearby  RED 
equipment. 

8.9.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  equipment  from  BLACK 
wire  lines. 

8.9.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BLACK  wire  lines 
picking  up  compromising  emanations  from  RED  equipment  and  escaping  the  inspectable  space  on  the 
BLACK  wire  lines. 

8.9.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BLACK  wire  lines,  are  controlled.  Normally,  this  countermeasure  is  not  needed  if  the 
line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  bound¬ 
ary  of  the  inspectable  space  is  greater  than  2,000  meters  or  if  the  BLACK  lines  are  fiber  optic. 

8.9.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  equipment  away  from  the  BLACK  wire 
lines  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.9.6.  Alternatives.  The  alternatives  to  fully  separating  RED  equipment  from  BLACK  wire  lines,  as 
required  in  the  applicable  countermeasures  review  attachment,  are: 

8.9.6. 1 .  Use  a  BLACK  wire  line  isolation  countermeasure.  This  reduces  the  separation  distance  to 
15  percent  of  the  required  distance  (minimum  15  centimeters),  or, 

8. 9. 6. 2.  Shield  the  BLACK  wire  lines.  This  reduces  the  separation  distance  to  5  percent  of  the 
required  distance  (minimum  5  centimeters),  or, 

8. 9. 6. 3.  Use  TEMPEST-certified  equipment.  This  reduces  the  separation  distance  to  5  centime¬ 
ters,  or, 

8. 9. 6. 4.  Shield  the  equipment  to  reduce  compromising  emanations  by  using  the  encapsulation 
technique.  This  reduces  the  separation  distance  to  5  percent  of  the  required  distance  (minimum  5 
centimeters).  If  there  are  several  RED  equipment  that  need  separation  from  several  BLACK 
equipment,  a  shielded  enclosure  will  meet  the  separation  requirement. 
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8.10.  Countermeasure  --  RED  Equipment  and  BLACK  Power  Line  Separation. 

8.10.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  in  RED  equipment  as  a  result 
of  state  changes  in  electronic  circuits  and  current  flow  in  traces  and  wires.  The  problem  is  BLACK 
power  lines  can  act  as  receiving  antennas  and  pick  up  compromising  emanations  radiated  from  nearby 
RED  equipment. 

8.10.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  equipment  from 
BLACK  power  lines. 

8.10.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BLACK  power  lines 
picking  up  compromising  emanations  from  RED  equipment  and  escaping  the  inspectable  space  on  the 
BLACK  power  lines. 

8.10.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BLACK  power  lines  and  BLACK  wire  lines,  are  controlled.  Normally,  this  counter¬ 
measure  is  not  needed  if: 

8.10.4.1.  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt- amperes  and  at  least  10,000  volts  potential,  and, 

8. 10.4.2.  The  line  distance  of  BLACK  wire  lines  connected  to  BLACK  equipment  from  the  build¬ 
ing  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000 
meters  or  the  BLACK  lines  are  fiber  optic. 

8. 10.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  equipment  away  from  the  BLACK  power 
lines  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.10.6.  Alternatives.  The  alternatives  to  fully  separating  RED  equipment  from  BLACK  power  lines, 
as  required  in  the  applicable  countermeasures  review  attachment,  are: 

8.10.6.1.  Shield  the  BLACK  power  lines.  This  reduces  the  separation  distance  to  5  percent  of  the 
required  distance  (minimum  5  centimeters),  or, 

8.10.6.2.  Use  TEMPEST-certified  equipment.  This  reduces  the  separation  distance  to  5  centime¬ 
ters,  or, 

8.10.6.3.  Shield  the  equipment  to  reduce  compromising  emanations  by  using  the  encapsulation 
technique.  This  reduces  the  separation  distance  to  5  percent  of  the  required  distance  (minimum  5 
centimeters).  If  there  are  several  RED  equipment  that  need  separation  from  several  BLACK 
equipment,  a  shielded  enclosure  will  meet  the  separation  requirement,  or, 

8.10.6.4.  Lilter  the  BLACK  power  lines.  This  reduces  the  separation  distance  to  5  percent  of  the 
required  distance  (minimum  5  centimeters). 

8.11.  Countermeasure  --  RED  Equipment  and  BLACK  Signal  Ground  Wire  Separation. 

8.11.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  in  RED  equipment  as  a  result 
of  state  changes  in  electronic  circuits  and  current  flow  in  traces  and  wires.  BLACK  signal  ground 
wires  can  act  as  receiving  antennas  and  pick  up  compromising  emanations  from  nearby  RED  equip¬ 
ment.  The  problem  is  BLACK  signal  ground  wires  can  pick  up  compromising  emanations.  They  can 
escape  in  three  ways: 
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8.11.1.1.  Conducting  them  to  the  shields  on  BLACK  wire  lines  where  they  can  be  conducted  to 
BLACK  equipment  and  escape  the  inspectable  space  on  the  BLACK  wire  lines  and  BLACK 
power  lines. 

8.11.1.2.  Condueting  them  to  the  shields  on  BLACK  wire  lines  where  they  can  be  impressed  on 
the  BLACK  wire  lines  and  escape  the  inspectable  space  on  the  BLACK  wire  lines. 

8.11.1.3.  Conducting  them  back  through  the  filters  on  BLACK  wire  lines  where  they  ean  be 
impressed  on  the  BLACK  wire  lines  and  eseape  the  inspectable  spaee  on  the  BLACK  wire  lines. 

8.11.2.  What  the  Countermeasure  Is.  The  eountermeasure  is  to  separate  RED  equipment  from 
BLACK  signal  ground  wires. 

8.11.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BLACK  signal 
ground  wires  picking  up  compromising  emanations  from  RED  equipment  and  escaping  the  inspeet- 
able  space  on  BEACK  wire  lines  and  BEACK  power  lines. 

8.11.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BEACK  wire  lines,  are  controlled.  Normally,  this  countermeasure  is  not  needed  if  the 
line  distance  of  the  BEACK  wire  lines  from  the  building  eontaining  the  RED  equipment  to  the  bound¬ 
ary  of  the  inspeetable  spaee  is  greater  than  1,000  meters  or  the  BEACK  lines  are  fiber  optic. 

8.11.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  equipment  away  from  the  BEACK  signal 
ground  wires  by  the  distance  specified  in  the  applicable  countermeasures  review  attaehment. 

8.11.6.  Alternatives.  The  alternatives  to  fully  separating  RED  equipment  from  BEACK  signal  ground 
wires,  as  required  in  the  applicable  countermeasures  review  attaehment,  are: 

8.11.6.1.  Use  a  BEACK  wire  line  isolation  countermeasure,  and, 

8.1 1.6.2.  Eilter  the  BEACK  power  lines,  or, 

8.11.6.3.  Use  TEMPEST-certified  equipment.  This  reduces  the  separation  distanee  to  5  centime¬ 
ters,  or, 

8.11.6.4.  Shield  the  equipment  to  reduce  compromising  emanations  by  using  the  encapsulation 
technique.  If  there  are  several  RED  equipment  that  need  separation  from  several  BEACK  equip¬ 
ment,  a  shielded  enclosure  will  meet  the  separation  requirement. 

8.12.  Countermeasure  --  RED  Equipment  and  Fortuitous  Conductor  Separation. 

8.12.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  in  RED  equipment  as  a  result 
of  state  ehanges  in  electronic  circuits  and  current  flow  in  traces  and  wires.  Eortuitous  conductors  can 
act  as  receiving  antennas  and  pick  up  compromising  emanations  radiated  from  nearby  RED  equip¬ 
ment.  The  problem  is  fortuitous  conductors  can  leave  the  inspectable  space  allowing  compromising 
emanations  to  escape  control.  An  additional  problem  is,  since  fortuitous  conductors  can  run  parallel  to 
BEACK  wire  lines  and  BEACK  power  lines,  compromising  emanations  can  be  coupled  to  them  and 
escape  if  the  BEACK  wire  lines  or  BEACK  power  lines  leave  the  inspectable  spaee. 

8.12.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  equipment  from  fortu¬ 
itous  conductors. 
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8.12.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  fortuitous  conductors 
picking  up  compromising  emanations  from  RED  equipment  and  escaping  the  inspectable  space  on  the 
fortuitous  conductors,  BLACK  wire  lines,  or  BLACK  power  lines. 

8.12.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  fortuitous  conductors,  BLACK  wire  lines,  and  BLACK  power  lines,  are  controlled. 
Normally,  this  countermeasure  is  not  needed  if  fortuitous  conductors  are  contained  within  the  inspect¬ 
able  space,  and: 

8. 12.4. 1 .  The  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  250  meters  or  the  BLACK  lines  are 
fiber  optic,  and, 

8.12.4.2.  The  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where 
the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 

8.12.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  equipment  away  from  the  fortuitous  con¬ 
ductors  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.12.6.  Alternatives.  The  alternatives  to  fully  separating  RED  equipment  from  fortuitous  conductors, 
as  required  in  the  applicable  countermeasures  review  attachment,  are: 

8.12.6.1.  Install  nonconductive  breaks  in  all  fortuitous  conductors  at  the  boundary  of  the  inspect¬ 
able  space,  and, 

8.12.6.2.  Separate  the  BLACK  wire  lines  from  BLACK  power  lines  by  the  distance  specified  in 
the  applicable  countermeasures  review  attachment,  or, 

8.12.6.3.  Shield  the  BLACK  wire  lines  and  BLACK  power  lines.  This  reduces  the  separation  dis¬ 
tance  to  5  percent  of  the  required  distance  (minimum  5  centimeters),  or, 

8.12.6.4.  Use  TEMPEST-certified  equipment.  This  reduces  the  separation  distance  to  5  centime¬ 
ters,  or, 

8.12.6.5.  Shield  the  equipment  to  reduce  compromising  emanations  by  encapsulation.  If  there  is 
RED  equipment  that  needs  separation  from  BLACK  equipment,  a  shielded  enclosure  will  meet  the 
separation  requirement. 

8.13.  Countermeasure  --  Low-Level  Signaling. 

8.13.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  in  RED  equipment  as  a  result 
of  state  changes  in  electronic  circuits,  current  flow  in  traces  and  wires,  switches  opening  and  closing, 
energizing  and  de-energizing  solenoids,  creating  images  on  screens  with  electron  streams,  and  many 
other  similar  actions.  The  problem  is  the  stronger  the  emanations,  the  more  hazards  there  are. 

8.13.2.  What  the  Countermeasure  Is.  The  requirement  is  to  use  low-level  signaling  within  and 
between  equipment. 

8.13.3.  What  the  Countermeasure  Does.  This  requirement  reduces  the  strength  of  compromising 
emanations.  The  separation  requirements  established  in  this  memorandum  are  based  on  low-level  sig¬ 
naling. 
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8.13.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  when  there  is 
over  10,000  meters  of  inspectable  space,  all  wires  are  shielded,  and  RED  equipment  is  separated  from 
BLACK  equipment  10  times  the  required  distance.  CTTA  assistance  is  a  must  in  this  situation. 

8.13.5.  How  To  Apply  the  Countermeasure.  A  low-level  signal  is  a  current-driven  signal,  plus  or 
minus  2  volts  at  70  microamperes,  or  a  voltage-driven  signal,  plus  or  minus  6  volts. 

8.13.6.  Alternative.  This  requirement  is  not  needed  when  the  equipment  is  installed  in  a  shielded 
enclosure  or  when  there  is  over  10,000  meters  of  inspectable  space,  all  wires  are  shielded,  and  RED 
equipment  is  separated  from  BLACK  equipment  ten  times  the  required  distance. 

8.14.  Signal  Lines.  There  are  two  kinds  of  signal  lines,  wire  and  fiber  optic.  Signal  wire  lines  are  metal¬ 
lic  wires  that  carry  an  electrical  signal  from  one  piece  of  equipment  to  another.  Liber  optic  lines  that  carry 
signals  also  are  called  “signal  lines”  but  not  “signal  wire  lines”.  Signal  wire  lines  are  also  known  as  cables 
or  conductors.  Signal  wire  lines  vary  according  to  equipment  design.  A  mix  of  single  wires,  twisted  pair, 
coaxial,  and  ribbon  is  typically  found.  Twisted  pair  cable  is  predominant  between  large  systems  and 
within  facilities.  Signal  wire  lines,  which  carry  current,  generate  an  electromagnetic  field  around  the  wire 
that  produces  an  electromagnetic  wave;  in  other  words,  the  signal  wire  line  acts  as  a  transmitting  antenna. 
The  magnitude  of  this  field  is  directly  related  to  the  magnitude  of  the  signal  and  varies  as  the  signal  varies. 
Additionally,  in  the  case  of  digital  signals,  the  transitions  from  mark-to-space  and  space-to-mark  (or 
one-to-zero  and  zero-to-one  or  high-to-low  and  low-to-high)  can  produce  radiated  electromagnetic  spikes 
much  larger  than  the  original  magnitude  of  the  signal-state  change.  If  processing  classified  information, 
then  these  are  compromising  emanations  and  may  require  EMSEC  countermeasures. 

8.15.  RED  and  BLACK  Wire  Lines.  RED  wire  lines  carry  clear-text,  classified,  and  classified  infor¬ 
mation.  BLACK  wire  lines  carry  unclassified  information  or  encrypted  classified  information.  Designat¬ 
ing  signal  lines  as  RED  or  BLACK  further  ensures  the  physical  and  electrical  separation  requirement. 
Every  signal  conductor  from  a  RED  device  is  routed  only  to  another  RED  device  or  is  encrypted  prior  to 
connecting  to  a  BLACK  device. 

8.16.  Countermeasure  --  RED  Wire  Line  and  BLACK  Equipment  Separation. 

8.16.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  around  RED  wire  lines  as  a 
result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromagnetic  wave; 
in  other  words,  the  RED  wire  line  acts  as  a  transmitting  antenna.  The  wires,  traces,  frame,  and  covers 
of  BLACK  equipment  can  act  as  receiving  antennas  and  pick  up  the  compromising  emanations.  The 
problem  is  if  compromising  emanations  are  picked  up  by  BLACK  equipment,  they  can  escape  on 
BLACK  wire  lines  connected  to  the  BLACK  equipment  and  on  the  BLACK  power  cord  connected  to 
the  BLACK  equipment. 

8.16.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  wire  lines  from 
BLACK  equipment. 

8.16.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BLACK  equipment 
picking  up  compromising  emanations  from  RED  wire  lines  and  escaping  the  inspectable  space  on 
BLACK  wire  lines  or  BLACK  power  lines  connected  to  the  BLACK  equipment. 
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8.16.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BLACK  wire  lines  and  BLACK  power  lines,  are  controlled.  Normally,  this  counter¬ 
measure  is  not  needed  if: 

8.16.4.1.  The  line  distance  of  the  BLACK  wire  line  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are 
fiber  optic,  and, 

8.16.4.2.  The  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where 
the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 

8.16.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  wire  lines  away  from  the  BEACK  equip¬ 
ment  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment.  Traditionally, 
under  ideal  conditions,  areas  were  established  in  a  facility  for  the  placement  of  RED  equipment  sepa¬ 
rate  and  unique  from  areas  with  BEACK  equipment.  When  this  was  done,  two  areas  were  created:  A 
RED  equipment  area  and  a  BEACK  equipment  area.  A  RED  equipment  area  is  the  space  within  a 
CAA  where  RED  information  processing  equipment  and  associated  power,  signal,  control,  ground, 
and  signal  distribution  facilities  are  installed.  A  BEACK  equipment  area  is  an  area  in  a  CAA  where 
equipment  processing  unclassified  information  or  encrypted  classified  information  and  associated 
power,  signal,  control,  ground,  and  distribution  facilities  are  installed.  However,  today  most  classified 
information  is  processed  in  an  office  environment.  Often,  this  environment  does  not  lend  itself  to 
establishing  RED  equipment  areas  and  BEACK  equipment  areas  easily.  However,  achieving  and 
maintaining  the  separation  is  required.  If  data  from  an  EMSEC  test  determines  that  a  hazard  exists,  a 
countermeasure  to  consider  is  to  increase  the  physical  separation  distance.  A  further  problem  is 
offices  are  rearranged  from  time  to  time  that  can  lead  to  a  natural  laxness  where  the  separation 
requirements  are  forgotten. 

8.16.6.  Alternatives.  The  alternatives  to  fully  separating  RED  wire  lines  from  BEACK  equipment,  as 
required  in  the  applicable  countermeasures  review  attachment,  are: 

8.16.6.1.  Use  a  BEACK  wire  line  isolation  countermeasure.  This  reduces  the  separation  distance 
to  15  percent  of  the  required  distance  (minimum  15  centimeters),  or, 

8.16.6.2.  Shield  the  RED  wire  lines  to  reduce  compromising  emanations.  This  reduces  the  sepa¬ 
ration  distance  to  15  percent  of  the  required  distance  (minimum  15  centimeters). 

8.17.  Countermeasure  --  RED  Wire  Line  and  BLACK  Wire  Line  Separation. 

8.17.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  around  RED  wire  lines  as  a 
result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromagnetic  wave; 
in  other  words,  the  RED  wire  line  acts  as  a  transmitting  antenna.  The  problem  is  BEACK  wire  lines 
can  act  as  receiving  antennas  and  pick  up  the  compromising  emanations. 

8.17.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  wire  lines  from 
BEACK  wire  lines. 

8.17.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BEACK  wire  lines 
picking  up  compromising  emanations  from  RED  wire  lines  and  escaping  the  inspectable  space  on 
BEACK  wire  lines.  Separation  also  reinforces  the  requirement.  Every  signal  conductor  from  a  RED 
device  is  routed  only  to  another  RED  device  or  is  encrypted  prior  to  connecting  to  a  BEACK  device. 
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8.17.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BLACK  wire  lines,  are  controlled.  Normally,  this  countermeasure  is  not  needed  if  the 
line  distance  of  the  BLACK  wire  line  from  the  building  containing  the  RED  equipment  to  the  bound¬ 
ary  of  the  inspectable  space  is  greater  than  2,000  meters  or  if  the  BLACK  lines  are  fiber  optic. 

8.17.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  wire  lines  away  from  the  BEACK  wire 
lines  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.17.6.  Alternatives.  The  alternatives  to  fully  separating  RED  wire  lines  from  BEACK  wire  lines,  as 
required  in  the  applicable  countermeasures  review  attachment,  are: 

8.17.6.1.  Use  a  BEACK  wire  line  isolation  countermeasure.  This  reduces  the  separation  distance 
to  15  percent  of  the  required  distance  (minimum  15  centimeters),  or, 

8.17.6.2.  Shield  the  RED  wire  lines  to  reduce  compromising  emanations.  This  reduces  the  sepa¬ 
ration  distance  to  15  percent  of  the  required  distance  (minimum  15  centimeters),  or, 

8.17.6.3.  Shield  the  BEACK  wire  lines  to  prevent  them  from  picking  up  compromising  emana¬ 
tions.  This  reduces  the  separation  distance  to  15  percent  of  the  required  distance  (minimum  15 
centimeters),  or, 

8.17.6.4.  Shield  both  the  RED  and  BEACK  wire  lines  This  reduces  the  separation  distance  to  5 
percent  of  the  required  distance  (the  signal  lines  do  not  touch). 

8.18.  Countermeasure  --  RED  Wire  Line  and  BLACK  Power  Line  Separation. 

8.18.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  around  RED  wire  lines  as  a 
result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromagnetic  wave; 
in  other  words,  the  RED  wire  line  acts  as  a  transmitting  antenna.  The  problem  is  BEACK  power  lines 
can  act  as  receiving  antennas  and  pick  up  the  compromising  emanations. 

8.18.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  wire  lines  from 
BEACK  power  lines. 

8.18.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BEACK  power  lines 
picking  up  compromising  emanations  from  RED  wire  lines  and  escaping  the  inspectable  space  on 
BEACK  power  lines  and,  to  a  lesser  degree,  BEACK  wire  lines  connected  to  BEACK  equipment. 

8.18.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BEACK  power  lines  and  BEACK  wire  lines,  are  controlled.  Normally,  this  counter¬ 
measure  is  not  needed  if: 

8.18.4.1.  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt- amperes  and  at  least  10,000  volts  potential,  and, 

8.18.4.2.  The  line  distance  of  the  BEACK  wire  line  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BEACK  lines  are 
fiber  optic. 

8.18.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  wire  lines  away  from  the  BEACK  power 
by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.18.6.  Alternatives.  The  alternatives  to  fully  separating  RED  wire  lines  from  BEACK  power  lines, 
as  required  in  the  applicable  countermeasures  review  attachment,  are: 
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8.18.6.1.  Filter  BLACK  power  lines.  This  reduces  the  separation  distance  to  15  percent  of  the 
required  distance  (minimum  15  centimeters),  or, 

8.18.6.2.  Shielding  the  RED  wire  lines  to  reduce  compromising  emanations.  This  reduces  the  sep¬ 
aration  distance  to  15  percent  of  the  required  distance  (minimum  15  centimeters),  or, 

8.18.6.3.  Shielding  the  BLACK  power  lines  to  prevent  them  from  picking  up  compromising  ema¬ 
nations.  This  reduces  the  separation  distance  to  15  percent  of  the  required  distance  (minimum  15 
centimeters),  or, 

8.18.6.4.  Shielding  both  the  RED  wire  lines  and  BLACK  power  lines.  This  reduces  the  separation 
distance  to  5  percent  of  the  required  distance  (the  signal  lines  do  not  touch),  and, 

8.18.6.5.  Use  a  BLACK  wire  line  isolation  countermeasure. 

8.19.  Countermeasure  --  RED  Wire  Line  and  BLACK  Signal  Ground  Wire  Separation. 

8.19.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  around  RED  wire  lines  as  a 
result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromagnetic  wave; 
in  other  words,  the  RED  wire  line  acts  as  a  transmitting  antenna.  BLACK  signal  ground  wires  can  act 
as  receiving  antennas  and  pick  up  the  compromising  emanations.  The  problem  is  BLACK  signal 
ground  wires  can  pick  up  compromising  emanations.  The  picked  up  compromising  emanations  can 
escape  in  three  ways: 

8.19.1.1.  Conducting  them  to  the  shields  on  BLACK  wire  lines  where  they  can  be  conducted  to 
BLACK  equipment  and  escape  the  inspectable  space  on  the  BLACK  wire  lines  and  BLACK 
power  lines. 

8.19.1.2.  Conducting  them  to  the  shields  on  BLACK  wire  lines  where  they  can  be  impressed  on 
the  BLACK  wire  lines  and  escape  the  inspectable  space  on  the  BLACK  wire  lines. 

8.19.1.3.  Conducting  them  back  through  the  filters  on  BLACK  wire  lines  where  they  can  be 
impressed  on  the  BLACK  wire  lines  and  escape  the  inspectable  space  on  the  BLACK  wire  lines. 

8.19.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  wire  lines  from 
BLACK  signal  ground  wires. 

8.19.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BLACK  signal 
ground  wires  picking  up  compromising  emanations  from  RED  wire  lines  and  escaping  the  inspectable 
space  on  BLACK  wire  lines  and,  to  a  lesser  degree,  BLACK  power  lines. 

8.19.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BLACK  wire  lines,  are  controlled.  Normally,  this  countermeasure  is  not  needed  if  the 
line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  bound¬ 
ary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic. 

8.19.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  wire  lines  away  from  the  BLACK  signal 
ground  wires  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.19.6.  Alternatives.  The  alternatives  to  fully  separating  RED  wire  lines  from  BLACK  signal  ground 
wires,  as  required  in  the  applicable  countermeasures  review  attachment,  are: 

8.19.6.1.  Use  a  BLACK  wire  line  isolation  countermeasure,  and, 

8.19.6.2.  Lilter  the  BLACK  power  lines,  or. 
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8.19.6.3.  Shield  the  RED  wire  lines.  This  reduces  the  separation  distance  to  15  percent  of  the 
required  distance  (minimum  15  centimeters),  or, 

8.19.6.4.  Do  all  of  the  above.  This  reduces  the  separation  distance  to  5  percent  of  the  required  dis¬ 
tance  (the  signal  lines  do  not  touch). 

8.20.  Countermeasure  --  RED  Wire  Line  and  Fortuitous  Conductor  Separation. 

8.20.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  around  RED  wire  lines  as  a 
result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromagnetic  wave; 
in  other  words,  the  RED  wire  line  acts  as  a  transmitting  antenna.  Eortuitous  conductors  can  act  as 
receiving  antennas  and  pick  up  the  compromising  emanations.  The  problem  is  fortuitous  conductors 
can  leave  the  inspectable  space  allowing  compromising  emanations  to  escape  control.  An  additional 
problem  is,  since  fortuitous  conductors  can  run  parallel  to  BEACK  wire  lines  and  BEACK  power 
lines,  compromising  emanations  can  get  coupled  to  them  and  leave  the  inspectable  space  if  the 
BEACK  wire  lines  or  BEACK  power  lines  leave  the  inspectable  space. 

8.20.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  wire  lines  from  fortu¬ 
itous  conductors. 

8.20.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  fortuitous  conductors 
picking  up  compromising  emanations  from  RED  wire  lines  and  escaping  the  inspectable  space  on  the 
fortuitous  conductors,  BEACK  wire  lines,  or  BEACK  power  lines. 

8.20.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  fortuitous  conductors,  BEACK  wire  lines,  and  BEACK  power  lines,  are  controlled. 
Normally,  this  countermeasure  is  not  needed  if  fortuitous  conductors  are  contained  within  the  inspect¬ 
able  space,  and: 

8.20.4. 1 .  The  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  250  meters  or  the  BEACK  lines  are 
fiber  optic,  and, 

8.20.4.2.  The  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where 
the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 

8.20.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  wire  lines  away  from  the  fortuitous  con¬ 
ductors  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.20.6.  Alternatives.  The  alternatives  to  fully  separating  RED  wire  lines  from  fortuitous  conductors, 
as  required  in  the  applicable  countermeasures  review  attachment,  are: 

8.20.6.1.  Install  nonconductive  breaks  in  all  fortuitous  conductors  at  the  boundary  of  the  inspect¬ 
able  space,  and, 

8.20.6.2.  Shield  the  RED  wire  lines.  This  reduces  the  separation  distance  to  5  percent  of  the 
required  distance  (minimum  5  centimeters),  or, 

8.20.6.3.  Separate  the  BEACK  wire  lines  from  BEACK  power  lines  by  the  distance  specified  in 
the  applicable  countermeasures  review  attachment,  or, 

8.20.6.4.  Shield  the  BEACK  wire  lines  and  BEACK  power  lines.  This  reduces  the  separation  dis¬ 
tance  to  5  percent  of  the  required  distance  (minimum  5  centimeters). 
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8.21.  Shielded  Signal  Wire  Lines.  Shielding  signal  wire  lines  precludes  an  easy  escape  of  compromis¬ 
ing  emanations.  To  be  effective,  do  not  use  the  shield  as  a  signal  return  path,  especially  for  coaxial  cables. 
In  effect,  a  shielded  coaxial  cable  is  a  triaxial  cable.  In  addition,  use  ferrous  shielding  (iron  pipe)  for 
high-level  signals,  or  where  indicated  by  an  EMSEC  test.  Make  sure  the  shields  for  a  cable  or  set  of  wire 
lines  are  a  continuous  low  resistance  run  by  proper  termination  of  all  joints  and  splices.  Do  not  connect 
the  shields  of  cables  to  equipment  cases,  thereby  making  the  cable  shield  common  to  the  alternating  cur¬ 
rent  (AC)  protective  ground.  Terminate  nonferrous  cable  shields  to  the  signal  ground  system  at  both  ends, 
whenever  possible. 

8.22.  Fiber  Optic  Signal  Lines.  An  alternative  to  shielding  signal  wire  lines  is  to  use  fiber  optic  signal 
lines.  A  fiber  optic  system  consists  of  a  sending  unit,  an  optical  fiber,  and  a  receiving  unit.  The  sending 
unit  converts  an  electrical  signal  to  an  optical  signal  (light).  The  optical  signal  is  then  injected  into  the 
optical  fiber.  The  optical  fiber  carries  the  optical  signal  to  the  receiving  unit.  The  receiving  unit  converts 
the  optical  signal  back  to  an  electrical  signal. 

8.22. 1 .  Although  fiber  optic  systems  are  expensive  and  somewhat  delicate,  they  have  several  EMSEC 
advantages  (as  well  as  data  capacity)  over  conventional  metallic  cables. 

8.22.1.1.  Optical  fibers  are  nonmetallic,  therefore,  they  do  not  radiate  or  pick  up  electromagnetic 
energy  and  since  the  transmission  medium  is  light,  they  are  not  easily  affected  by  electromagnetic 
fields.  This  property  effectively  eliminates  crosstalk. 

8.22.1.2.  Optical  fibers  are  nonconducting  so  fiber  optic  systems  are  not  subject  to  ground  loops 
or  shorting  problems  nor  are  they  prone  to  pick  up  stray  emanations. 

8.22.1.3.  Tiber  optic  systems  are  not  subject  to  the  transmission  of  common-mode  signals. 

8.22. 1 .4.  Transmission  security  is  improved  since  intrusion  without  detection  is  more  difficult  for 
fiber  optic  systems  than  metallic  cables.  Physical  tapping  is  necessary  to  sample  data,  resulting  in 
physical  evidence  of  tampering.  Also,  if  properly  designed,  equipped,  and  installed,  using  the 
detectable  reduction  in  signal  level  as  an  alarm  sensor  is  permitted. 

8.22.2.  Installation  standards  for  fiber  optic  systems  are  not  the  same  as  those  for  conventional  metal¬ 
lic  cables.  The  installation  standards  are: 

8.22.2. 1 .  Route  a  RED  fiber  optic  cable  that  traverses  a  BEACK  area  in  such  a  way  as  to  allow  for 
easy  detection  of  intrusion. 

8.22.2.2.  When  transmitting  RED  and  BEACK  information  through  individual  fibers  bundled 
together  or  in  a  multifiber  cable,  provide  an  opaque  separation  between  the  RED  fibers  and  the 
BEACK  fibers  and  separate  the  sending  equipment  from  the  receiving  equipment  as  specified  in 
the  applicable  countermeasures  review  attachment. 

8.22.2.3.  When  individual  RED  and  BEACK  fiber  optic  signal  lines  are  run  in  the  same  distribu¬ 
tion  facility,  cover  each  fiber  with  opaque  cladding  and  separate  the  sending  equipment  from  the 
receiving  equipment  as  specified  in  the  applicable  countermeasures  review  attachment. 

8.22.2.4.  Do  not  use  RED  fiber  optic  cables  with  metal  strength  members  or  conductive  cladding 
to  traverse  BEACK  areas  and  vice  versa.  This  same  requirement  applies  to  armored  fiber  optic 
cables.  Any  such  metal  component  in  the  cable  is  a  fortuitous  conductor.  If  a  fiber  optic  cable  with 
metallic  strength  members,  conductive  cladding,  or  armor  must  be  used,  ground  the  metallic 
strength  members,  conductive  cladding,  or  armor  at  both  ends  of  the  fiber  optic  cable. 
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8.22.2.5.  Mark  the  RED  fiber  as  any  other  RED  conductor  according  to  paragraph  on  marking 
distribution  facilities. 

8.22.2.6.  Running  RED  fiber  optic  signal  lines  with  BEACK  metallic  cables  or  BEACK  fiber 
optic  signal  lines  with  RED  metallic  cables  is  permitted. 

8.22.2.7.  The  sending  and  receiving  units  must  meet  the  same  EMSEC  countermeasure  require¬ 
ments  as  any  other  RED  processor  in  the  area. 

8.23.  Countermeasure  --  Shielded  RED  Wire  Lines. 

8.23.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  around  RED  wire  lines  as  a 
result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromagnetic  wave; 
in  other  words,  the  RED  wire  line  acts  as  a  transmitting  antenna.  The  problem  is  these  compromising 
emanations  can  be  picked  up  by  BEACK  equipment,  BEACK  wire  lines,  BEACK  power  lines,  and 
fortuitous  conductors. 

8.23.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  shield  the  RED  wire  lines  to  contain 
compromising  emanations. 

8.23.3.  What  the  Countermeasure  Does.  Shielding  RED  wire  lines  tends  to  contain  compromising 
emanations  within  the  RED  wire  lines;  that  is,  they  do  not  radiate.  This  prevents  their  escape  on 
BEACK  wire  lines,  BEACK  power  lines,  and  fortuitous  conductors. 

8.23.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BEACK  wire  lines,  BEACK  power  lines,  and  fortuitous  conductors,  are  controlled. 
Normally,  this  countermeasure  is  not  needed  if: 

8.23.4.1.  All  required  separation  distances  for  BEACK  equipment,  BEACK  wire  lines,  RED 
power  lines,  RED  signal  ground  wires,  and  BEACK  signal  ground  wires  from  BEACK  equip¬ 
ment,  BEACK  wire  lines,  BEACK  power  lines  and  fortuitous  conductors  are  met,  or, 

8.23.4.2.  Where  the  required  separation  distance  for  RED  equipment,  RED  wire  lines,  RED 
power  lines,  RED  signal  ground  wires,  or  BEACK  signal  ground  wires  from  BEACK  equipment 
is  not  met  but  the  line  distance  of  the  BEACK  wire  lines  connected  to  BEACK  equipment  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  1,000  meters  or  the  BEACK  lines  are  fiber  optic,  and, 

8.23.4.3.  Where  the  required  separation  distance  for  RED  equipment,  RED  wire  lines,  RED 
power  lines,  RED  signal  ground  wires,  or  BEACK  wire  lines  from  BEACK  wire  lines  is  not  met 
but  the  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to 
the  boundary  of  the  inspectable  space  is  greater  than  2,000  meters  or  the  BEACK  lines  are  fiber 
optic,  and, 

8.23.4.4.  Where  the  required  separation  distance  for  RED  equipment,  RED  wire  lines,  RED 
power  lines,  RED  signal  ground  wires,  or  BEACK  signal  ground  wires  from  BEACK  power  lines 
is  not  met  but  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where 
the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential,  and, 

8.23.4.5.  Where  the  required  separation  distance  for  RED  equipment,  RED  wire  lines,  RED 
power  lines,  RED  signal  ground  wires,  or  BEACK  signal  ground  wires  from  fortuitous  conductors 
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is  not  met  but  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  250  meters. 

8.23.5.  How  To  Apply  the  Countermeasure.  Requirements  for  shielded  cables  are  in  Attachment  18. 
Ground  the  shielding  at  both  ends  of  the  shielded  wire  line.  Grounding  at  only  one  end  reduces  the 
shielding  effectiveness  by  approximately  75  percent. 

8.23.6.  Alternatives.  The  alternatives  to  shielding  RED  wire  lines  are  to: 

8.23.6.1.  Separate  RED  wire  lines  from  BEACK  equipment,  BEACK  wire  lines,  BEACK  power 
lines,  and  fortuitous  conductors  by  the  distance  specified  in  the  applicable  countermeasures 
review  attachment,  or, 

8.23.6.2.  Shield  the  BEACK  equipment,  and, 

8.23.6.3.  Shield  the  BEACK  wire  lines,  or  use  a  BEACK  wire  line  isolation  countermeasure,  and, 

8.23.6.4.  Shield  BEACK  power  lines,  and, 

8.23.6.5.  Install  nonconductive  breaks  in  all  fortuitous  conductors  at  the  boundary  of  the  inspect¬ 
able  space. 

8.24.  Countermeasure  --  Shielded  BLACK  Wire  Lines. 

8.24.1.  What  the  Problem  Is.  There  are  many  sources  of  compromising  emanations.  Compromising 
emanations  are  produced  in  and  radiated  from  RED  equipment  as  a  result  of  state  changes  in  elec¬ 
tronic  circuits  and  current  flow  in  traces  and  wires.  Compromising  emanations  are  produced  around 
RED  wire  lines  as  a  result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an 
electromagnetic  wave;  in  other  words,  RED  wire  lines  act  as  transmitting  antennas.  RED  power  lines 
can  radiate  compromising  emanations  as  either  changes  to  the  amplitude  of  the  input  power  or 
changes  in  the  relationship  of  the  voltage  and  current.  RED  power  lines  can  also  radiate  conducted 
compromising  emanations  traveling  on  the  power  lines.  The  problem  is,  BEACK  wire  lines  can  act  as 
receiving  antennas  and  pick  up  the  compromising  emanations. 

8.24.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  shield  BEACK  wire  lines. 

8.24.3.  What  the  Countermeasure  Does.  Shielding  BEACK  wire  lines  tends  to  prevent  compromising 
emanations  from  being  picked  up  (acting  as  a  receiving  antenna)  by  BEACK  wire  lines  and  escaping 
the  inspectable  space  on  BEACK  wire  lines. 

8.24.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BEACK  wire  lines,  are  controlled.  Normally,  this  countermeasure  is  not  needed  if: 

8.24.4.1.  All  required  separation  distances  for  RED  equipment,  RED  wire  lines,  RED  power 
lines,  RED  signal  ground  wires,  BEACK  signal  ground  wires,  and  fortuitous  conductors  from 
BEACK  wire  lines  are  met,  or, 

8.24.4.2.  Where  the  required  separation  distance  for  RED  equipment,  RED  power  lines,  RED  sig¬ 
nal  ground  wires,  BEACK  signal  ground  wires,  or  fortuitous  conductors  from  BEACK  wire  lines 
is  not  met  and  the  line  distance  of  the  BEACK  wire  lines  connected  to  BEACK  equipment  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  1,000  meters  or  the  BEACK  lines  are  fiber  optic,  and. 
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8.24.4.3.  Where  the  required  separation  distance  for  RED  wire  lines  from  BLACK  wire  lines  is 
not  met  and  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  2,000  meters  or  the  BLACK 
lines  are  fiber  optic. 

8.24.5.  How  To  Apply  the  Countermeasure.  Requirements  for  shielded  cables  are  in  Attachment  18. 
Ground  the  shielding  at  both  ends  of  the  shielded  wire  line.  Grounding  at  only  one  end  reduces  the 
shielding  effectiveness  by  approximately  75  percent. 

8.24.6.  Alternatives.  The  alternatives  to  shielding  BLACK  wire  lines  are  to: 

8.24.6.1.  Separate  BLACK  wire  lines  from  RED  equipment,  RED  wire  lines,  RED  power  lines, 
and  fortuitous  conductors  by  the  distance  specified  in  the  applicable  countermeasures  review 
attachment,  or, 

8.24.6.2.  Use  a  BLACK  wire  line  isolation  countermeasure,  or, 

8.24.6.3.  Shield  the  RED  equipment,  RED  wire  lines,  and  RED  power  lines  and  separate  BLACK 
wire  lines  from  fortuitous  conductors  by  the  distance  specified  in  the  applicable  countermeasures 
review  attachment. 

8.25.  Countermeasure  —  BLACK  Wire  Line  Isolation. 

8.25.1.  What  the  Problem  Is.  There  are  many  sources  of  compromising  emanations.  Compromising 
emanations  are  produced  in  and  radiated  from  RED  equipment  as  a  result  of  state  changes  in  elec¬ 
tronic  circuits  and  current  flow  in  traces  and  wires.  Compromising  emanations  are  produced  around 
RED  wire  lines  as  a  result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an 
electromagnetic  wave;  in  other  words,  the  RED  wire  line  acts  as  a  transmitting  antenna.  RED  power 
lines  can  radiate  compromising  emanations  as  either  changes  to  the  amplitude  of  the  input  power  or 
changes  in  the  relationship  of  the  voltage  and  current.  RED  power  lines  can  also  radiate  conducted 
compromising  emanations  traveling  on  the  power  line.  The  problem  is  BLACK  wire  lines  can  act  as 
receiving  antennas  and  pick  up  the  compromising  emanations. 

8.25.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  isolate  BLACK  wire  lines  using 
band-pass  filters,  photo-isolators,  fiber  optic  cables,  or  cryptographic  equipment. 

8.25.3.  What  the  Countermeasure  Does.  Isolating  BLACK  wire  lines  tends  to  prevent  compromising 
emanations  picked  up  by  BLACK  wire  lines  from  leaving  the  inspectable  space  on  BLACK  wire 
lines. 

8.25.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BLACK  wire  lines,  are  controlled.  Normally,  this  countermeasure  is  not  needed  if: 

8.25.4.1.  All  required  separation  distances  for  RED  equipment,  RED  wire  lines,  RED  power 
lines,  RED  signal  ground  wires,  BLACK  signal  ground  wires,  and  fortuitous  conductors  from 
BLACK  equipment,  BLACK  wire  lines,  and  BLACK  signal  ground  wires  are  met,  or, 

8.25.4.2.  Where  the  required  separation  distance  for  RED  equipment,  RED  wire  lines,  RED 
power  lines,  RED  signal  ground  wires,  BLACK  signal  ground  wires,  and  fortuitous  conductors 
from  BLACK  equipment  or  BLACK  power  lines  is  not  met  and  the  line  distance  of  the  BLACK 
wire  lines  connected  to  BLACK  equipment  from  the  building  containing  the  RED  equipment  to 
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the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber 
optic,  and, 

8.25.4.3.  Where  the  required  separation  distance  for  RED  equipment,  RED  power  lines,  RED  sig¬ 
nal  ground  wires,  BEACK  signal  ground  wires,  and  fortuitous  conductors  from  BEACK  wire  lines 
is  not  met  and  the  line  distance  of  the  BEACK  wire  lines  connected  to  BEACK  equipment  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  1,000  meters  or  the  BEACK  lines  are  fiber  optic,  and, 

8.25.4.4.  Where  the  required  separation  distance  for  RED  wire  lines  from  BEACK  wire  lines  is 
not  met  and  the  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  2,000  meters  or  the  BEACK 
lines  are  fiber  optic. 

8.25.5.  How  To  Apply  the  Countermeasure. 

8.25.5.1.  Band-Pass  Eilters.  Band-pass  filters  pass  frequencies  within  a  design  pass  band  and 
block  those  outside  the  pass  band.  The  cutoff  is  not  instantaneous  and  usually  requires  a  decade 
(10  times)  or  more  to  reach  maximum  filtering.  In  other  words,  if  a  100  dB  filter  is  designed  to 
pass  voice  frequency  signals  (0  to  4000  hertz),  filtering  starts  at  4000  hertz  but  does  not  reach  100 
dB  of  filtering  until  40,000  hertz.  Install  band-pass  filters  on  BEACK  wire  lines  to  block  all  sig¬ 
nals  outside  a  specified  frequency  range.  Where  modems  or  other  analog  signal  generators  contain 
band-pass  filters  as  part  of  the  design,  do  not  apply  additional  filtering.  A  detailed  discussion  of 
filter  parameters  is  contained  in  Attachment  19. 

8.25.5.2.  Photon-Coupled  Isolators.  Photon-coupled  isolators  use  lightwave  technologies  to  cou¬ 
ple  signals  between  two  points.  These  isolators  are  ideal  for  EMSEC  applications  since  there  is  no 
conductive  path  exploitable  as  a  probe.  Signals  are  passed  from  the  input  portion  to  the  output  por¬ 
tion  using  lightguides.  When  the  lightguide  is  installed  in  a  waveguide  beyond  cutoff,  the  isolator 
is  ideal  for  use  in  shielded  installations  where  conducting  penetrations  are  kept  to  a  minimum. 
While  photon-coupled  isolators  are  usually  a  must  for  digital  signals,  they  are  also  acceptable  for 
analog  signals.  A  detailed  discussion  of  photon-coupled  isolators  is  contained  in  Attachment  19. 

8.25.5.3.  Eiber  Optics.  In  most  cases,  a  fiber  optic  system  will  meet  the  isolation  requirement.  The 
transmitters  and  receivers  of  the  fiber  optic  system  provide  some  filtering  to  optimize  the  system 
and  reduce  errors  caused  by  noise.  Also,  the  level  of  the  compromising  emanations  is  usually 
small  enough  so  that  conversion  from  electrical  signal  to  light  is  less  likely  to  occur.  Eurther  deg¬ 
radation  of  compromising  emanations  is  provided  at  the  receiving  end  when  the  conversion  from 
light  back  to  an  electrical  signal  occurs.  It  is  most  probable  that  the  intensity  of  the  compromising 
emanations  is  not  enough  to  break  the  decision  threshold.  Isolate  or  ground  any  metallic  strength 
members  in  the  fiber  optic  bundle  at  both  ends. 

8.25.5.4.  Cryptographic  Equipment.  Cryptographic  equipment  are  excellent  filtering  devices  pro¬ 
vided  they  are  installed  according  to  the  installation  standards  in  the  technical  publications  related 
to  the  cryptographic  equipment  or,  lacking  such  guidance,  follow  the  guidance  contained  in  Chap¬ 
ter  4.  However,  it  is  possible  to  negate  the  effectiveness  of  the  filtering  provided  by  cryptographic 
equipment  if  modems  used  on  the  encrypted  circuits  are  not  installed  carefully.  A  generous  allow¬ 
ance  for  minimum  separation  distance  of  the  modems  from  the  cryptographic  equipment  and  all 
RED  equipment  is  an  absolute  must.  Also,  the  signal  wire  lines  from  the  modem  to  the  outside 
world  may  require  shielding. 
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8.25.6.  Alternatives.  The  alternatives  to  BLACK  wire  line  isolation  are  to: 

8.25.6.1.  Separate  BLACK  wire  lines  from  RED  equipment,  RED  wire  lines,  RED  power  lines, 
and  fortuitous  eonductors  by  the  distanee  specified  in  the  applicable  countermeasures  review 
attachment,  or, 

8.25.6.2.  Shield  the  B  EAC  K  lines ,  or, 

8.25.6.3.  Shield  the  RED  equipment,  RED  wire  lines,  and  RED  power  lines  and  separate  BEACK 
wire  lines  from  fortuitous  conductors  by  the  distance  specified  in  the  applicable  countermeasures 
review  attachment. 

8.26.  RED  and  BLACK  Power. 

8.26.1.  When  an  item  of  equipment  processes  information,  it  can  create  noise  that  may  appear  on  the 
equipment  power  cord.  If  the  equipment  is  processing  classified  information  and  these  noise  signals 
reveal  the  processed  information,  then  these  noise  signals  are  compromising  emanations.  The  power 
lines  the  power  cord  is  plugged  in  to  may  conduct  the  compromising  emanations  outside  the  inspect- 
able  space. 

8.26.2.  Power  lines  with  compromising  emanations  on  them  may  conduct  the  compromising  emana¬ 
tions  to  other  equipment  connected  to  the  same  power  lines.  If  any  of  these  items  of  equipment  have 
signal  wire  lines  that  leave  the  inspectable  space,  the  compromising  emanations  can  find  their  way  to 
these  signal  wire  lines  and  escape  the  inspectable  space. 

8.26.3.  Power  lines,  carrying  current,  generate  an  electromagnetic  field  around  the  wire  that  produces 
an  electromagnetic  wave;  in  other  words,  the  signal  wire  line  acts  as  a  transmitting  antenna.  This  is 
more  so  for  compromising  emanations  on  a  power  line  than  the  normal  AC  due  to  the  wavelength. 
Compromising  emanations  are  usually  much,  much  higher  in  frequency,  and  thus,  more  readily  prop¬ 
agate  from  power  lines  than  the  AC.  The  magnitude  of  this  field  is  directly  related  to  the  magnitude  of 
the  signal  and  varies  as  the  signal  varies.  Additionally,  in  the  case  of  digital  signals,  the  transitions 
from  mark-to-space  and  space-to-mark  (or  one-to-zero  and  zero-to-one,  or  high-to-low  and 
low-to-high)  can  produce  radiated  electromagnetic  spikes  much  larger  than  the  original  magnitude  of 
the  signal-state  change.  The  electromagnetic  field  can  radiate  into  free  space  and  couple  onto  other 
conducting  mediums.  The  wires,  traces,  frame,  and  cover  of  electronic  equipment,  other  signal  wires, 
power  lines,  and  fortuitous  conductors  can  act  as  a  receiving  antennas  picking  up  the  compromising 
emanations. 

8.26.4.  The  electromagnetic  field  surrounding  a  wire  that  carries  a  current  can  impress  current  in 
another  parallel  wire  through  an  effect  called  mutual  inductance.  In  other  words,  the  first  wire  acts  as 
a  transmitting  antenna  and  the  second  wire  acts  as  a  receiving  antenna.  Other  power  lines,  signal 
cables,  ground  wires  and  fortuitous  conductors  can  act  as  receiving  antennas  picking  up  the  compro¬ 
mising  emanations. 

8.26.5.  The  first  step  in  controlling  these  effects  is  to  separate  power  into  RED  and  BEACK  power. 
The  separate  power  provided  to  equipment  and  systems  that  process  classified  information  that  are  not 
TEMPEST-certified  is  called  RED  power.  BEACK  power  is  provided  for  TEMPEST-certified  equip¬ 
ment,  cryptographic  equipment,  equipment  not  processing  classified  information,  and  supporting  ser¬ 
vices.  TEMPEST-certified  and  cryptographic  equipment  have  adequate  internal  power  filtering  to 
permit  the  use  of  BEACK  power. 
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8.27.  Countermeasure  --  RED  Power. 

8.27.1.  What  the  Problem  Is.  When  equipment  processes  information,  it  can  create  noise  that  may 
appear  on  the  equipment’s  power  cord.  In  the  case  of  RED  equipment,  this  noise  may  be  compromis¬ 
ing  emanations.  The  problem  is  power  lines  may  conduct  the  compromising  emanations  to  BLACK 
equipment  with  signal  lines  that  exit  the  inspectable  space  if  the  BLACK  equipment  is  connected  to 
the  same  power  circuit.  Also,  compromising  emanations  may  be  conducted  on  power  lines  that  exit 
the  inspectable  space. 

8.27.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  install  a  separate  power  circuit  for  the 
RED  equipment. 

8.27.3.  What  the  Countermeasure  Does.  RED  power  provides  a  separate  AC  power  circuit  for  RED 
equipment.  This  separate  power  circuit  isolates  the  power  for  RED  equipment  from  the  power  for 
BLACK  equipment  minimizing  the  probability  of  conducting  compromising  emanations  to  BLACK 
equipment.  RED  power  also  establishes  a  separate  power  circuit  so  filters  may  be  added  to  prevent 
compromising  emanations  escaping  the  inspectable  space  on  power  lines  when  determined  a  hazard 
by  an  EMSEC  test. 

8.27.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BLACK  wire  lines  and  BLACK  power  lines,  are  controlled.  Normally,  this  counter¬ 
measure  is  not  needed  if: 

8.27.4.1.  The  line  distance  of  the  BLACK  wire  lines  connected  to  BLACK  equipment  from  the 
building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than 
1,000  meters  or  the  BLACK  lines  are  fiber  optic,  or, 

8.27.4.2.  A  BLACK  wire  line  isolation  countermeasure  is  used,  and, 

8.27.4.3.  The  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where 
the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 

8.27.5.  How  To  Apply  the  Countermeasure.  Install  a  separate  power  circuit  from  the  circuit  breaker 
box  to  the  items  of  RED  equipment.  Connect  RED  equipment  to  this  power  circuit.  Do  not  connect 
TEMPEST-certified  equipment  to  this  RED  power  circuit.  Do  not  connect  cryptographic  equipment  to 
this  RED  power  circuit  unless  the  technical  manuals  for  the  cryptographic  equipment  require  it.  Do 
not  connect  any  BLACK  equipment  with  signal  lines  that  exit  the  inspectable  space  to  this  RED 
power  circuit. 

8.27.6.  Alternatives. 

8.27.6.1.  Use  a  BLACK  wire  line  isolation  countermeasure,  or, 

8.27.6.2.  Use  TEMPEST-certified  equipment,  or, 

8.27.6.3.  Use  a  shielded  enclosure. 

8.28.  Countermeasure  --  Filtered  RED  Power. 

8.28.1.  What  the  Problem  Is.  When  equipment  processes  information,  it  can  create  noise  that  may 
appear  on  the  equipment’s  power  cord.  In  the  case  of  RED  equipment,  this  noise  may  be  compromis¬ 
ing  emanations.  The  problem  is  compromising  emanations  can  escape  the  inspectable  space  on  power 
lines  that  exit  the  inspectable  space. 
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8.28.2.  What  the  Countermeasure  Is.  The  eountermeasure  is  to  filter  the  RED  power. 

8.28.3.  What  the  Countermeasure  Does.  Filtering  RED  power  prevents  eompromising  emanations 
eseaping  on  power  lines  that  exit  the  inspectable  spaee. 

8.28.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BEACK  power  lines,  are  controlled.  Normally,  this  countermeasure  is  not  needed  if  the 
power  lines  feeding  the  RED  power  circuit  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 

8.28.5.  How  To  Apply  the  Countermeasure.  Base  the  decision  to  require  this  countermeasure  on  the 
results  of  an  EMSEC  test  that  shows  compromising  emanations  escaping  the  inspectable  space  on 
power  lines.  There  are  a  number  of  ways  to  “filter”  RED  power.  Choose  one  of  the  following  based  on 
practicality  and  cost  considerations. 

8.28.5.1.  Power  Fine  Filters. 

8.28.5.1.1.  The  passive  inductive-capacitive  filter  is  one  method  to  remove  compromising 
emanations  from  conductors  of  all  types.  Such  filters  are  in  general  use  to  prevent  radio  fre¬ 
quencies  from  interfering  with  equipment  operation.  When  filtering  power  lines,  two  schools 
of  thought  exist:  that  which  advocates  bulk  filtering  for  the  entire  facility,  and  that  which  advo¬ 
cates  individually  filtering  each  equipment  of  concern.  The  individual  equipment  method  is 
the  preferred  technique  as  this  assures  that  the  filter  design  parameters  will  match  the  equip¬ 
ment. 

8.28.5. 1 .2.  Some  equipment  manufactured  under  the  auspices  of  the  Federal  Communications 
Commission  Regulation,  Part  15,  Subpart  J,  may  contain  filters.  While  these  filters  will  atten¬ 
uate  signals  coupled  to  the  power  lines,  the  degree  of  suppression  most  probably  will  not  meet 
EMSEC  requirements.  In  such  cases,  replacing  the  manufacturer's  installed  filter  with  one  that 
meets  the  requirement  may  prove  satisfactory.  If  that  is  not  possible,  other  precautionary  mea¬ 
sures  are  required.  A  designer  may  consider  the  use  of  bulk  filtering  or  rack  filtering  in  such 
instances.  Exercise  caution  in  such  cases,  as  additional  filtering  often  creates  two  additional 
problems.  The  first  is  harmonic  distortion  that  lowers  the  filter  cutoff  frequency  that  could 
lower  the  band-pass  limit.  The  second  is  interaction  between  the  parameters  of  the  two  filters 
that  results  in  a  significant,  but  varying,  overall  reduction  of  filtering  action. 

8.28.5.1.3.  Install  filters,  electrically,  between  the  circuit  breaker  box  and  the  RED  equip¬ 
ment.  Install  the  filters,  physically,  beyond  the  ERTZ  of  the  RED  equipment  or  shield  the 
incoming  side  of  the  filters  to  a  point  beyond  the  ERTZ  of  the  RED  equipment. 

8.28.5.1.4.  Attachment  19  contains  additional  information  on  power  line  filters.  Vendors' 
catalogs  typically  provide  detailed  information  for  available  filters.  If  the  appropriate  filter  is 
not  readily  available,  have  one  designed  and  manufactured  to  meet  needs.  Provide  the  follow¬ 
ing  information  to  the  filter  manufacturer:  equipment  nomenclature,  operating  line  voltage, 
operating  line  frequency,  source  impedance,  load  impedance,  load  current,  desired  band-pass 
frequency  (or  operating  line  frequency),  and  acceptable  insertion  loss. 

8.28.5.2.  Isolation  Transformers.  Use  isolation  transformers  to  break  ground  loops  to  reduce  com¬ 
mon-mode  and  differential-mode  noise.  An  isolation  transformer  equipped  with  triple  Faraday 
shields  is  very  effective  in  blocking  compromising  emanations  in  both  the  power  mains  and  the 
branch  feeds.  It  is  possible  to  use  a  transformer  with  a  1:1  ratio  or  step-down.  Install  it  as  close  to 


56 


AFMAN33-214V2  21  SEPTMEBER  2001 


the  load  equipment  as  possible,  preferably  in  the  same  room,  but  outside  the  ERTZ  of  the  RED 
equipment.  If  the  transformer  is  located  within  the  ERTZ  of  the  RED  equipment,  shield  the  incom¬ 
ing  power  lines  to  the  transformer.  Also,  if  the  transformer  is  installed  according  to  the  National 
Electric  Code,  Article  250-5(d),  it  becomes  a  separately  derived  system,  and  as  such,  establishes  a 
new  fault  protection  subsystem.  Do  not  tie  it  to  the  green  wire  ground  serving  the  power  main  side 
as  this  defeats  the  intent  of  the  National  Electric  Code  for  protection.  It  also  negates  the  EMSEC 
isolation  desired  in  using  this  type  of  transformer  to  break  ground  loops.  Eurther,  sometimes  isola¬ 
tion  transformers  are  designed  with  the  ground  and  neutral  conductors  in  common  with  the  pri¬ 
mary  and  secondary  windings.  This  also  nullifies  the  EMSEC  ground  isolation  benefit  of  this  type 
of  transformer. 

8.28.5.3.  Uninterruptible  Power  Supplies.  Many  installations  using  computers  or  process-control 
equipment  employ  an  uninterruptible  power  supply  and  voltage  regulation  as  a  method  of  provid¬ 
ing  glitch-free  power.  Certain  aspects  of  uninterruptible  power  supplies  aid  in  containing  con¬ 
ducted  emissions. 

8.28.5.3.1.  Rotating  Uninterruptible  Power  Supplies.  The  rotating  uninterruptible  power  sup¬ 
ply  is  the  most  used  uninterruptible  power  supply  in  existence.  Whether  constructed  as  a 
motor-generator  or  a  no-break  generator  using  an  inertia  flywheel,  its  basic  principles  of  oper¬ 
ation  provide  a  degree  of  isolation  between  power  mains  and  loads.  The  typical  structure  is  an 
AC  synchronous  motor  driving  a  generator.  Such  systems  offer  high  immunity  of  the  load 
from  line  disturbance.  However,  some  configurations  do  not  provide  isolation  for  conducted 
emissions.  This  is  particularly  true  if  the  AC  motor  is  mounted  on  a  common  shaft  with  the 
generator  or  in  a  common  housing.  If  the  motor  and  generator  shafts  and  housings  are  electri¬ 
cally  isolated,  this  path  of  escape  of  compromising  emanations  is  eliminated.  Systems  employ¬ 
ing  direct  current  (DC)  motors  offer  isolation  regardless  of  the  configuration.  In  such  systems, 
conducted  emissions  are  suppressed  in  the  DC  power  supply  driving  the  motor  and  in  the  bat¬ 
tery  system. 

8.28.5.3.2.  Solid-State  Uninterruptible  Power  Supplies.  In  theory,  the  solid-state  uninterrupt¬ 
ible  power  supply  should  offer  high  isolation  of  conducted  emissions  by  the  nature  of  its  oper¬ 
ation. 

8.28.5.3.2.1.  Solid-state  uninterruptible  power  supplies  take  the  incoming  AC  through  a 
DC  converter  or  rectifier.  The  filtering  section  of  the  rectifier  should  greatly  attenuate  con¬ 
ducted  emissions.  The  DC  voltage  supplies  an  inverter  section  that  synthesizes  a  sinewave. 
This  sinewave  is  further  filtered.  Thus,  the  probability  of  a  conducted  compromising  ema¬ 
nation  feeding  back  to  the  power  mains  is  greatly  reduced.  Eurther,  a  solid-state  uninter¬ 
ruptible  power  supply  may  contain  a  battery  bank  floated  across  the  DC  voltage.  Such  an 
arrangement  provides  excellent  filtering  for  TEMPEST  requirements. 

8.28.5.3.2.2.  There  are  a  number  of  small  solid-state  uninterruptible  power  supplies 
designed  for  individual  items  of  equipment.  Most  of  these  small  solid-state  uninterruptible 
power  supplies  do  not  attenuate  compromising  emanations,  significantly;  a  few  even 
amplify  compromising  emanations.  These  may  be  used  for  individual  items  of  RED  equip¬ 
ment  provided  they  have  been  tested  and  shown  to  attenuate  compromising  emanations. 

8.28.6.  Alternatives.  The  alternatives  to  filtered  RED  power  are: 

8.28.6.1.  Use  TEMPEST-certified  equipment. 
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8.28.6.2.  Use  a  shielded  enclosure. 

8.29.  Countermeasure  --  RED  Power  Line  and  BLACK  Equipment  Separation. 

8.29.1.  What  the  Problem  Is.  When  RED  equipment  processes  information,  it  can  create  compromis¬ 
ing  emanations  that  may  appear  on  the  equipment’s  power  cord  and  be  conducted  to  the  RED  power 
lines.  These  compromising  emanations  can  generate  a  magnetic  field  around  the  RED  power  lines  that 
produce  an  electromagnetic  wave;  in  other  words,  the  RED  power  lines  act  as  transmitting  antennas. 
The  wires,  traces,  frame,  and  covers  of  BEACK  equipment  can  act  as  receiving  antennas  and  pick  up 
the  compromising  emanations.  The  problem  is  if  compromising  emanations  are  picked  up  by  BEACK 
equipment,  they  can  escape  on  BEACK  wire  lines  connected  to  the  BEACK  equipment  and  on  the 
BEACK  power  cord  connected  to  the  BEACK  equipment. 

8.29.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  power  lines  from 
BEACK  equipment. 

8.29.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BEACK  equipment 
picking  up  compromising  emanations  from  RED  power  lines  and  escaping  the  inspectable  space  on 
BEACK  wire  lines  and  BEACK  power  lines. 

8.29.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BEACK  wire  lines  and  BEACK  power  lines,  are  controlled.  Normally,  this  counter¬ 
measure  is  not  needed  if: 

8.29.4. 1 .  The  line  distance  of  BEACK  wire  lines  connected  to  BEACK  equipment  from  the  build¬ 
ing  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000 
meters  or  the  BEACK  lines  are  fiber  optic,  or, 

8.29.4.2.  A  BEACK  wire  line  isolation  countermeasure  is  used,  and, 

8.29.4.3.  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 

8.29.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  power  lines  away  from  the  BEACK 
equipment  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment.  Tradition¬ 
ally,  under  ideal  conditions,  areas  were  established  in  a  facility  for  the  placement  of  RED  equipment 
separate  and  unique  from  areas  with  BEACK  equipment.  When  this  was  done,  two  areas  were  created: 
a  RED  equipment  area  and  a  BEACK  equipment  area.  A  RED  equipment  area  is  the  space  within  a 
CAA  where  RED  information  processing  equipment  and  associated  power,  signal,  control,  ground, 
and  signal  distribution  facilities  are  installed.  A  BEACK  equipment  area  is  an  area  in  a  CAA  where 
equipment  processing  unclassified  information  or  encrypted  classified  information  and  associated 
power,  signal,  control,  ground,  and  distribution  facilities  are  installed.  However,  today,  most  classified 
information  is  processed  in  an  office  environment.  Often,  this  environment  does  not  lend  itself  to 
establishing  RED  equipment  areas  and  BEACK  equipment  areas  easily.  However,  achieving  and 
maintaining  the  separation  of  RED  power  lines  and  BEACK  equipment  may  be  required.  If  an 
EMSEC  test  determines  that  a  hazard  exists,  a  countermeasure  to  consider  is  to  increase  the  physical 
separation  distance.  A  further  problem  is  offices  are  rearranged  from  time  to  time  that  can  lead  to  a 
natural  laxness  where  the  separation  requirements  are  forgotten. 

8.29.6.  Alternatives.  The  alternatives  to  fully  separating  RED  power  lines  from  BEACK  equipment, 
as  required  in  the  applicable  countermeasures  review  attachment,  are: 
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8.29.6.1.  Use  a  BLACK  wire  line  isolation  countermeasure.  This  reduces  the  separation  distance 
to  15  percent  of  the  required  distance  (minimum  15  centimeters),  or, 

8.29.6.2.  Shield  the  RED  power  lines.  This  reduces  the  separation  distance  to  15  percent  of  the 
required  distance  (minimum  15  centimeters),  or, 

8.29.6.3.  Use  equipment  where  the  strength  of  the  compromising  emanations  have  been  reduced. 
This  normally  means  TEMPEST-certified  equipment.  This  reduces  the  separation  distance  to  5 
percent  of  the  required  distance  (minimum  5  centimeters),  or, 

8.29.6.4.  Shield  the  equipment  to  reduce  compromising  emanations  by  using  the  encapsulation 
technique.  This  reduces  the  separation  distance  to  5  percent  of  the  required  distance  (minimum  5 
centimeters).  If  there  are  several  items  of  RED  equipment  that  need  separation  from  several  items 
of  BEACK  equipment,  an  alternative  to  consider  is  using  a  shielded  enclosure. 

8.30.  Countermeasure  --  RED  Power  Line  and  BLACK  Wire  Line  Separation. 

8.30.1.  What  the  Problem  Is.  When  RED  equipment  processes  information,  it  can  create  compromis¬ 
ing  emanations  that  may  appear  on  the  equipment’s  power  cord  and  be  conducted  to  the  RED  power 
lines.  These  compromising  emanations  can  generate  a  magnetic  field  around  the  RED  power  lines  that 
produce  an  electromagnetic  wave;  in  other  words,  the  RED  power  lines  act  as  transmitting  antennas. 
The  problem  is  BEACK  wire  lines  can  act  as  receiving  antennas  and  pick  up  compromising  emana¬ 
tions  from  nearby  RED  power  lines. 

8.30.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  power  lines  from 
BEACK  wire  lines. 

8.30.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BEACK  wire  lines 
picking  up  compromising  emanations  from  RED  power  lines  and  escaping  the  inspectable  space  on 
the  BEACK  wire  lines. 

8.30.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BEACK  wire  lines,  are  controlled.  Normally,  this  countermeasure  is  not  needed  if  the 
line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  bound¬ 
ary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines  are  fiber  optic. 

8.30.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  power  lines  away  from  the  BEACK  wire 
lines  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.30.6.  Alternatives.  The  alternatives  to  fully  separating  RED  power  lines  from  BEACK  wire  lines, 
as  required  in  the  applicable  countermeasures  review  attachment,  are: 

8.30.6.1.  Use  a  BEACK  wire  line  isolation  countermeasure.  This  reduces  the  separation  distance 
to  15  percent  of  the  required  distance  (minimum  15  centimeters),  or, 

8.30.6.2.  Shield  the  BEACK  wire  lines.  This  reduces  the  separation  distance  to  5  percent  of  the 
required  distance  (minimum  5  centimeters),  or, 

8.30.6.3.  Shield  the  RED  power  lines.  This  reduces  the  separation  distance  to  15  percent  of  the 
required  distance  (minimum  15  centimeters),  or. 
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8.30.6.4.  Use  equipment  where  the  strength  of  the  compromising  emanations  has  been  reduced. 
This  normally  means  TEMPEST-certified  equipment.  This  reduces  the  separation  distance  to  5 
percent  of  the  required  distance  (minimum  5  centimeters),  or, 

8.30.6.5.  Shield  the  equipment  to  reduce  compromising  emanations  by  using  the  encapsulation 
technique.  This  reduces  the  separation  distance  to  5  percent  of  the  required  distance  (minimum  5 
centimeters).  If  there  are  several  RED  equipment  that  need  separation  from  several  BEACK 
equipment,  a  shielded  enclosure  will  meet  the  separation  requirement. 

8.31.  Countermeasure  --  RED  Power  Line  and  BLACK  Power  Line  Separation. 

8.31.1.  What  the  Problem  Is.  When  RED  equipment  processes  information,  it  can  create  compromis¬ 
ing  emanations  that  may  appear  on  the  equipment’s  power  cord  and  be  conducted  to  the  RED  power 
lines.  These  compromising  emanations  can  generate  a  magnetic  field  around  the  RED  power  lines  that 
produce  an  electromagnetic  wave;  in  other  words,  the  RED  power  lines  act  as  transmitting  antennas. 
The  problem  is  BEACK  power  lines  can  act  as  receiving  antennas  and  pick  up  compromising  emana¬ 
tions  from  nearby  RED  power  lines. 

8.31.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  power  lines  from 
BEACK  power  lines. 

8.31.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BEACK  power  lines 
picking  up  compromising  emanations  from  RED  power  lines  and  escaping  the  inspectable  space  on 
the  BEACK  power  lines. 

8.31.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BEACK  power  lines  and  BEACK  wire  lines,  are  controlled.  Normally,  this  counter¬ 
measure  is  not  needed  if: 

8.3 1 .4. 1 .  The  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where 
the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential,  and, 

8.3 1 .4.2.  The  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines 
are  fiber  optic. 

8.31.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  power  lines  away  from  the  BEACK 
power  lines  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.31.6.  Alternatives.  The  alternatives  to  fully  separating  RED  power  lines  from  BEACK  power  lines, 
as  required  in  the  applicable  countermeasures  review  attachment,  are: 

8.31.6.1.  Shield  the  BEACK  power  lines.  This  reduces  the  separation  distance  to  5  percent  of  the 
required  distance  (minimum  5  centimeters),  or, 

8.31.6.2.  Shield  the  RED  power  lines.  This  reduces  the  separation  distance  to  15  percent  of  the 
required  distance  (minimum  15  centimeters),  or, 

8.31.6.3.  Use  equipment  where  the  strength  of  the  compromising  emanations  has  been  reduced. 
This  normally  means  TEMPEST-certified  equipment.  This  reduces  the  separation  distance  to  5 
percent  of  the  required  distance  (minimum  5  centimeters),  or. 


60 


AFMAN33-214V2  21  SEPTMEBER  2001 


8.31.6.4.  Shield  the  equipment  to  reduce  compromising  emanations  by  using  the  encapsulation 
technique.  This  reduces  the  separation  distance  to  5  percent  of  the  required  distance  (minimum  5 
centimeters).  If  there  is  RED  equipment  that  needs  separation  from  BLACK  equipment,  a  shielded 
enclosure  will  meet  the  separation  requirement,  or, 

8.31.6.5.  Filter  the  BLACK  power  lines.  This  reduces  the  separation  distance  to  5  percent  of  the 
required  distance  (minimum  5  centimeters). 

8.32.  Countermeasure  --  RED  Power  Line  and  BLACK  Signal  Ground  Wire  Separation. 

8.32.1.  What  the  Problem  Is.  When  RED  equipment  processes  information,  it  can  create  compromis¬ 
ing  emanations  that  may  appear  on  the  equipment’s  power  cord  and  be  conducted  to  the  RED  power 
lines.  These  compromising  emanations  can  generate  a  magnetic  field  around  the  RED  power  lines  that 
produce  an  electromagnetic  wave;  in  other  words,  the  RED  power  lines  act  as  transmitting  antennas. 
BLACK  signal  ground  wires  can  act  as  receiving  antennas  and  pick  up  compromising  emanations 
from  nearby  RED  equipment.  The  problem  is  if  BLACK  signal  ground  wires  pick  up  compromising 
emanations.  The  picked  up  compromising  emanations  can  escape  in  three  ways: 

8.32.1.1.  Conducting  them  to  the  shields  on  BLACK  lines  where  they  can  be  conducted  to 
BLACK  equipment  and  escape  the  inspectable  space  on  the  BLACK  wire  lines  and  BLACK 
power  lines. 

8.32.1.2.  Conducting  them  to  the  shields  on  BLACK  lines  where  they  can  be  impressed  on  the 
BLACK  wire  lines  and  escape  the  inspectable  space  on  the  BLACK  wire  lines. 

8.32.1.3.  Conducting  them  back  through  the  filters  on  BLACK  wire  lines  where  they  can  be 
impressed  on  the  BLACK  wire  lines  and  escape  the  inspectable  space  on  the  BLACK  wire  lines. 

8.32.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  power  lines  from 
BLACK  signal  ground  wires. 

8.32.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BLACK  signal 
ground  wires  picking  up  compromising  emanations  from  RED  power  lines  and  escaping  the  inspect¬ 
able  space  on  BLACK  wire  lines  and  BLACK  power  lines. 

8.32.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BLACK  wire  lines  and  BLACK  power  lines,  are  controlled.  Normally,  this  counter¬ 
measure  is  not  needed  if: 

8.32.4. 1 .  The  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are 
fiber  optic,  and, 

8.32.4.2.  The  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where 
the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 

8.32.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  power  lines  away  from  the  BLACK  sig¬ 
nal  ground  wires  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.32.6.  Alternatives.  The  alternatives  to  fully  separating  RED  power  lines  from  BLACK  signal 
ground  wires,  as  required  in  the  applicable  countermeasures  review  attachment,  are: 

8.32.6.1.  Use  a  BLACK  wire  line  isolation  countermeasure,  and. 
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8.32.6.2.  Filter  the  BLACK  power  lines,  or, 

8.32.6.3.  Shield  the  RED  power  lines.  This  reduees  the  separation  distanee  to  15  pereent  of  the 
required  distance  (minimum  15  centimeters),  or, 

8.32.6.4.  Use  equipment  where  the  strength  of  the  compromising  emanations  has  been  reduced. 
This  normally  means  TEMPEST-certified  equipment.  This  reduces  the  separation  distance  to  5 
percent  of  the  required  distance  (minimum  5  centimeters),  or, 

8.32.6.5.  Shield  the  equipment  to  reduce  compromising  emanations  by  using  the  encapsulation 
technique.  If  there  is  RED  equipment  that  needs  separation  from  BEACK  equipment,  a  shielded 
enclosure  will  meet  the  separation  requirement. 

8.33.  Countermeasure  --  RED  Power  Line  and  Fortuitous  Conductor  Separation. 

8.33.1.  What  the  Problem  Is.  When  RED  equipment  processes  information,  it  can  create  compromis¬ 
ing  emanations  that  may  appear  on  the  equipment’s  power  cord  and  be  conducted  to  the  RED  power 
lines.  These  compromising  emanations  can  generate  a  magnetic  field  around  the  RED  power  lines  that 
produce  an  electromagnetic  wave;  in  other  words,  the  RED  power  lines  act  as  transmitting  antennas. 
Eortuitous  conductors  can  act  as  receiving  antennas  and  pick  up  compromising  emanations  from 
nearby  RED  equipment.  The  problem  is  fortuitous  conductors  can  leave  the  inspectable  space  allow¬ 
ing  compromising  emanations  to  escape  control.  An  additional  problem  is,  since  fortuitous  conductors 
can  run  parallel  to  BEACK  wire  lines  and  BEACK  power  lines,  compromising  emanations  can  get 
coupled  to  them  and  escape  if  the  BEACK  wire  lines  or  BEACK  power  lines  leave  the  inspectable 
space. 

8.33.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  power  lines  from  fortu¬ 
itous  conductors. 

8.33.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  fortuitous  conductors 
picking  up  compromising  emanations  from  RED  power  lines  and  escaping  the  inspectable  space  on 
the  fortuitous  conductors,  BEACK  wire  lines,  or  BEACK  power  lines. 

8.33.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  fortuitous  conductors,  BEACK  wire  lines,  and  BEACK  power  lines,  are  controlled. 
Normally,  this  countermeasure  is  not  needed  if: 

8.33.4.1.  Eortuitous  conductors  are  contained  within  the  inspectable  space,  and, 

8.33.4.2.  The  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  250  meters  or  the  BEACK  lines  are 
fiber  optic,  and, 

8.33.4.3.  The  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where 
the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 

8.33.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  power  lines  away  from  the  fortuitous 
conductors  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.33.6.  Alternatives.  The  alternatives  to  fully  separating  RED  power  lines  from  fortuitous  conduc¬ 
tors,  as  required  in  the  applicable  countermeasures  review  attachment,  are: 


62 


AFMAN33-214V2  21  SEPTMEBER  2001 


8.33.6.1.  Install  nonconductive  breaks  in  all  fortuitous  conductors  at  the  boundary  of  the  inspect- 
able  space,  and, 

8.33.6.2.  Separate  the  BLACK  wire  lines  and  BLACK  power  lines  from  fortuitous  conductors  by 
the  distance  specified  in  the  applicable  countermeasures  review  attachment,  or, 

8.33.6.3.  Shield  the  BLACK  wire  lines  and  BLACK  power  lines.  This  reduces  the  separation  dis¬ 
tance  to  5  percent  of  the  required  distance  (minimum  5  centimeters),  or, 

8.33.6.4.  Shield  the  RED  power  lines.  This  reduces  the  separation  distance  to  15  percent  of  the 
required  distance  (minimum  15  centimeters),  or, 

8.33.6.5.  Use  equipment  where  the  strength  of  the  compromising  emanations  is  reduced.  This 
normally  means  TEMPEST-certified  equipment.  This  reduces  the  separation  distance  to  5  percent 
of  the  required  distance  (minimum  5  centimeters),  or, 

8.33.6.6.  Shield  the  equipment  to  reduce  compromising  emanations  by  encapsulation.  If  there  is 
RED  equipment  that  needs  separation  from  BEACK  equipment,  a  shielded  enclosure  will  meet  the 
separation  requirement. 

8.34.  Introduction  to  Grounds.  The  grounding  scheme  in  a  facility  is  composed  of  two  parts:  the 
life-saving  ground  system  associated  with  the  power  and  physical  structure,  and  the  signal  ground  or 
zero-reference  system.  Each  has  a  separate  and  distinct  function.  A  signal  ground  is  used  to  establish  a 
zero-reference  for  electrical  and  electronic  equipment. 

8.34.1.  Grounding  Systems.  Older  facilities  not  upgraded  typically  use  single -point  grounding  meth¬ 
ods  that  were  adequate  for  the  time.  However,  the  single-point  grounding  system  cannot  adequately 
support  office  automation  and  automated  information  processing  systems.  Newer  facilities  use  equi- 
potential  grounding  techniques  that  overcome  the  limitations  of  the  older  systems.  The  equipotential 
system  greatly  simplifies  the  designers’ job  since  a  ground  connection  is  always  nearby. 

8.34.2.  Equipotential  Plane.  In  any  electrical  or  electronic  circuit,  it  is  essential  to  provide  a 
low-impedance  path  for  signals  and  currents  to  return  from  the  load  back  to  the  source.  "Noise"  in  a 
signal  wire  line  is  often  attributed  to  the  noise  signal  and  current,  finding  a  lower  impedance  return 
than  the  intended  path.  Where  filters  are  employed  in  circuit  design,  unwanted  signals  are  removed 
from  the  lines  and  shunted  to  another  conductor.  It  is  the  shunting  that  on  occasion  presents  problems. 
In  the  past,  where  single-point  grounding  systems  were  employed,  single  conductors  were  run  from 
each  item  of  equipment  and  tied  to  earth,  which  supposedly  acted  as  a  sump  for  such  unwanted  sig¬ 
nals.  This  situation  may  result  in  multiple  problems. 

8.34.2.1.  The  earth  is  not  a  sump  for  noise  currents.  Any  signal  shunted  to  the  ground  system 
might  circulate  through  multiple  branches  of  the  ground  system  in  an  effort  to  return  to  the  source. 
Due  to  uncontrolled  lengths,  impedance  mismatches,  and  signal  reflection,  such  signals  could 
radiate  from  the  conductors  or  contaminate  unprotected  conductors  leaving  the  inspectable  space. 

8.34.2.2.  A  single-point  ground  system  is  ineffective  at  higher  frequencies  and  higher  frequency 
signals  might  well  seek  other  lower  impedance  paths  to  return  to  the  source. 

8.34.2.3.  The  primary  cause  of  impedance  of  number  10- American  Wire  Gauge  (AWG)  wire  at  1 
MHz  is  skin  effect.  The  current  is  concentrated  on  the  outer  surface  of  the  wire  by  the  magnetic 
flux  density  at  the  center  of  the  conductor.  As  the  frequency  increases,  the  depth  of  penetration 
reduces,  increasing  the  radio  frequency  resistance  to  the  signal.  An  increase  in  conductor  size  does 
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not  significantly  reduce  the  radio  frequency  resistance.  For  example,  replacing  a  10-AWG  copper 
wire  with  8-AWG  copper  wire  changes  the  AC  resistance  at  1  MHz  from  0.032  ohms  per  meter  to 
0.025  ohms  per  meter. 

8.34.2.4.  Bond  all  equipment  signal  ground  terminals  to  the  grid  with  leads  as  short  as  possible, 
but  should  not  exceed  1/20  of  the  wavelength  of  the  highest  frequency  of  interest. 

8.34.3.  Single-Point  Ground.  There  are  cases  where  a  single-point  ground  is  the  only  viable  solution 
for  a  signal  grounding  scheme.  From  the  EMSEC  viewpoint,  a  single -point  ground  may  satisfy  the 
grounding  requirement  at  facilities  where:  (1)  no  station  ground  exists;  (2)  a  station  ground  exists,  but 
is  not  accessible;  and,  (3)  it  is  not  cost  effective  nor  practical  to  construct  an  equipotential  grounding 
system. 

8.34.4.  Eife-Saving  Ground.  Electrical  power  in  the  United  States  is  equipped  with  a  fault-protection 
subsystem,  commonly  known  as  the  green  wire  ground,  the  ground,  or  the  grounding  conductor. 

8.34.4. 1 .  The  purpose  of  the  life-saving  ground  is  to  provide  an  uninterrupted  current  path  back  to 
the  first  service  disconnect  or  transformer  for  fault  currents  that  may  occur  in  equipment,  thus 
reducing  the  risk  of  death  or  injury  from  electrical  shock.  The  specific  details  for  implementing 
this  subsystem  are  defined  in  the  National  Electric  Code,  Article  250.  The  grounding  conductor 
also  provides  a  path  to  earth  for  electrical  overstress  induced  into  equipment  by  lightning.  The 
National  Electric  Code  permits  the  use  of  metallic  conduits  and  wireways  as  a  fault-return  path. 
This  practice,  by  its  very  nature,  creates  EMSEC  problems. 

8.34.4.2.  Where  the  sections  of  wireway  or  pipe  are  joined,  a  high-frequency  impedance  or  dis¬ 
continuity  of  bond  exists,  causing  signal  reflection.  When  reflection  occurs,  a  high  probability 
exists  for  free-space  radiation.  Eurther,  where  wireway  or  conduit  is  used  as  a  fault  return,  there  is 
no  control  of  the  current  path  since  every  contact  with  another  metallic  object  creates  either 
another  current  path  or  another  discontinuity  of  bond. 

8.34.4.3.  Where  the  fault-protection  system  is  installed  with  contiguous  green  copper  wire,  the 
above  problems  are  eliminated.  Take  care  to  avoid  sharing  green  wires  between  equipment.  Dedi¬ 
cate  all  green  wires  to  their  current-carrying  distributions. 

8.34.4.4.  Some  equipment  designers  attempt  to  use  the  green  wire  system  as  a  signal  reference 
system.  This  is  not  acceptable  for  two  reasons.  Eirst,  the  code  does  not  intend  for  this  conductor  to 
carry  current,  except  in  fault  situations.  Second,  there  is  no  control  over  the  paths  a  signal  might 
take  between  two  pieces  of  equipment.  This  results  in  uncontrolled  differences  of  potential 
between  such  equipment,  which  can  result  in  a  degraded  or  nonoperational  condition.  The  poten¬ 
tially  large  loop  areas  formed  may  behave  as  loop  antennas,  resulting  in  compromising  emana¬ 
tions  being  radiated  beyond  the  inspectable  space. 

8.34.5.  Isolated  Ground.  Although  not  specifically  intended  for  EMSEC,  use  of  an  isolated  ground 
power  distribution  scheme  may  enhance  power  line  isolation  concepts.  This  type  of  distribution 
scheme  consists  of  isolated  ground  outlets,  an  isolated  power  distribution  panel,  and  an  isolated 
grounding  conductor. 

8.34.5.1.  The  isolated  ground  outlet  is  designed  with  no  electrical  bond  between  the  grounding 
terminal  and  the  frame  of  the  outlet.  This  prevents  automatic  coupling  of  the  ground  to  the  con¬ 
duit,  which  would  effectively  destroy  the  isolated  ground  concept.  Connect  the  grounding  conduc- 
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tor  between  the  grounding  terminal  on  the  outlet  and  the  grounding  bus  in  the  power  distribution 
panel. 

8.34.5.2.  Isolate  the  grounding  and  neutral  bus  bars  from  the  distribution  panel,  eonduit,  and  eaeh 
other  at  this  point.  Conneet  the  grounding  eonduetor  from  the  ground  bus  to  the  grounding  point 
of  the  facility  main  power  switchgear.  It  is  at  this  point  that  it  becomes  common  to  the  neutral  con¬ 
ductor  and  other  grounding  conductors  used  throughout  the  facility. 

8.34.5.3.  Connect  only  operational  equipment  to  the  power  panel.  Connect  lights,  air  handling 
systems,  utility  devices,  and  housekeeping  equipment  to  a  separate  panel  since  they  may  produce 
unwanted  noise  into  the  system.  Use  of  an  isolated  ground  power  distribution  scheme  will  effec¬ 
tively  isolate  equipment  which  processes  classified  information  connected  to  this  power  distribu¬ 
tion  system  from  other  electrical  devices  in  the  facility  not  connected  to  this  power  distribution 
system,  but  is  not  intended  to  replace  other  required  power  line  isolation  devices. 

8.35.  RED  and  BLACK  Signal  Grounds.  In  facilities  processing  classified  information,  the  signal 
ground,  or  zero-reference  system,  is  sometimes  subdivided  into  three  subsystems:  RED  signal  ground, 
BLACK  signal  ground,  and  unclassified  signal  ground.  The  RED  and  BLACK  signal  ground  subsystems 
carry  classified  information  as  compromising  emanations.  The  unclassified  signal  ground  subsystem  does 
not  carry  classified  information. 

8.35. 1 .  RED  Signal  Ground.  The  RED  signal  ground  is  for  non-TEMPEST-certified  RED  equipment, 
RED  cable  shields,  and  RED  power  line  filters.  Because  the  RED  signal  ground  carries  compromising 
emanations,  protect  it  to  the  same  degree  as  RED  wire  lines.  Connect  it  to  the  earth  electrode  sub¬ 
system  within  the  inspectable  space.  If  a  RED  signal  ground  exists  in  the  facility,  use  it.  If  a  signal  ref¬ 
erence  ground  is  needed  for  proper  operation  of  the  equipment  but  the  facility  does  not  need  to  control 
compromising  emanations,  a  RED  signal  ground  is  not  needed;  use  an  unclassified  signal  ground.  In 
these  cases,  connect  the  RED  signal  ground  on  cryptographic  equipment,  cable  shields,  and  RED 
equipment  to  the  unclassified  signal  ground.  Use  a  separate  wire  as  short  as  possible  to  connect  to  the 
signal  reference  ground.  Do  not  use  the  green  wire  safety  ground. 

8.35.2.  BLACK  Signal  Ground.  The  BLACK  signal  ground  is  for  BLACK  wire  line  filters  and 
BLACK  cable  shields.  The  following  four  conditions  are  required  because  the  BLACK  signal  ground 
carries  compromising  emanations:  (1)  protect  it  to  the  same  degree  as  RED  signal  ground;  (2)  connect 
the  BLACK  signal  ground  to  the  earth  electrode  subsystem  within  the  inspectable  space;  (3)  do  not 
ground  BLACK  equipment  to  BLACK  signal  ground;  and,  (4)  do  not  run  the  BLACK  signal  ground 
with  BLACK  wire  lines,  BLACK  power  lines,  or  any  RED  lines.  If  a  BLACK  signal  ground  is  estab¬ 
lished  in  the  facility,  use  it.  If  a  signal  reference  ground  is  needed  for  proper  operation  of  the  equip¬ 
ment  but  the  facility  does  not  need  to  control  compromising  emanations,  a  BLACK  signal  ground  is 
not  needed;  use  an  unclassified  signal  ground.  Connect  the  BLACK  signal  ground  on  cryptographic 
equipment,  cable  shields,  and  filters  to  this  signal  reference  ground.  Use  a  separate  wire  as  short  as 
possible  to  connect  to  the  signal  reference  ground.  Do  not  use  the  green  wire  safety  ground. 

8.35.3.  Unclassified  Signal  Ground.  This  is  the  same  signal  reference  ground  found  in  any  facility 
that  does  not  process  classified  information  but  needs  such  a  ground  for  proper  operation  of  the  equip¬ 
ment. 

8.35.4.  Basic  RED  and  BLACK  Signal  Grounds  Requirements.  Where  RED  or  BLACK,  or  both,  sig¬ 
nal  grounds  are  required,  meet  the  following  grounding  criteria: 
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8.35.4.1.  RED  and  BLACK  signal  grounds  are  not  required  exeept  for  faeilities  where  the  signal 
ground  is  not  totally  contained  within  the  inspectable  space.  Use  RED  and  BLACK  signal  grounds 
if  already  installed  and  are  within  10  meters  of  the  cryptographic  equipment.  Use  an  equipotential 
grounding  system  if  it  exists.  Otherwise,  use  an  existing  single-point  ground  system  until  the  facil¬ 
ity  undergoes  a  major  renovation. 

8.35.4.2.  Use  single-ought  American  Wire  Gauge  (written  1/0  AWG  and  pronounced  one-ought) 
insulated  cable  for  RED  and  BLACK  signal  ground  distribution  systems. 

8.35.4.3.  Protect  the  RED  and  BLACK  signal  ground  wires  (e.g.,  encased  in  emt). 

8.35.4.4.  Do  not  use  green  wire  safety  ground  as  a  RED  or  BLACK  signal  ground. 

8.35.4.5.  Separate  RED  grounding  systems  from  BLACK  grounding  systems  by  the  distance 
specified  for  RED  and  BLACK  wire  lines  in  the  applicable  countermeasures  review  attachment. 

8.35.4.6.  Make  all  runs  to  RED  or  BLACK  equipment  in  emt.  As  required,  use  no  more  than  2 
meters  of  flex  conduit  to  connect  to  the  RED  or  BLACK  signal  ground  system.  Keep  the  lengths 
of  all  ground  conductors  as  short  as  possible  to  reduce  the  impedance  to  the  earth  electrode  sub¬ 
system. 

8.35.4.7.  Ground  cryptographic  equipment  following  the  guidance  in  the  technical  publications 
related  to  the  cryptographic  equipment  or,  lacking  such  guidance,  following  the  guidance  in 

Chapter  4. 

8.36.  Countermeasure  --  RED  Signal  Ground  Wire  and  BLACK  Equipment  Separation. 

8.36.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  around  RED  signal  ground 
wires  as  a  result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromag¬ 
netic  wave;  in  other  words,  RED  signal  ground  wires  act  as  transmitting  antennas.  The  wires,  traces, 
frame,  and  covers  of  BLACK  equipment  can  act  as  receiving  antennas  and  pick  up  the  compromising 
emanations.  The  problem  is  if  compromising  emanations  are  picked  up  by  BLACK  equipment,  they 
can  escape  on  BLACK  wire  lines  connected  to  the  BLACK  equipment  and  on  the  BLACK  power  cord 
connected  to  the  BLACK  equipment. 

8.36.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  signal  ground  wires 
from  BLACK  equipment. 

8.36.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BLACK  equipment 
picking  up  compromising  emanations  from  RED  signal  ground  wires  and  escaping  the  inspectable 
space  on  BLACK  wire  lines  or  BLACK  power  lines  connected  to  the  BLACK  equipment. 

8.36.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BLACK  wire  lines  and  BLACK  power  lines,  are  controlled.  Normally,  this  counter¬ 
measure  is  not  needed  if: 

8.36.4. 1 .  The  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are 
fiber  optic,  and, 

8.36.4.2.  The  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where 
the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 
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8.36.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  signal  ground  wires  away  from  the 
BLACK  equipment  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 
Traditionally,  under  ideal  conditions,  areas  were  established  in  a  facility  for  the  placement  of  RED 
equipment  separate  and  unique  from  areas  with  BLACK  equipment.  When  this  was  done,  two  areas 
were  created:  a  RED  equipment  area  and  a  BLACK  equipment  area.  A  RED  equipment  area  is  the 
space  within  a  CAA  where  RED  information  processing  equipment  and  associated  power,  signal,  con¬ 
trol,  ground,  and  signal  distribution  facilities  are  installed.  A  BLACK  equipment  area  is  an  area  in  a 
CAA  where  equipment  processing  unclassified  information  or  encrypted  classified  information  and 
associated  power,  signal,  control,  ground,  and  distribution  facilities  are  installed.  However,  today, 
most  classified  information  is  processed  in  an  office  environment.  Often,  this  environment  does  not 
lend  itself  to  establishing  RED  equipment  areas  and  BLACK  equipment  areas  easily.  However, 
achieving  and  maintaining  the  separation  is  required.  If  data  from  an  EMSEC  test  determines  that  a 
hazard  exists,  a  countermeasure  to  consider  is  to  increase  the  physical  separation  distance.  A  further 
problem  is  offices  are  rearranged  from  time  to  time  that  can  lead  to  a  natural  laxness  where  the  sepa¬ 
ration  requirements  are  forgotten. 

8.36.6.  Alternatives.  The  alternatives  to  fully  separating  RED  signal  ground  wires  from  BLACK 
equipment,  as  required  in  the  applicable  countermeasures  review  attachment,  are: 

8.36.6.1.  Use  a  BLACK  wire  line  isolation  countermeasure.  This  reduces  the  separation  distance 
to  15  percent  of  the  required  distance  (minimum  15  centimeters),  and, 

8.36.6.2.  Eilter  the  BLACK  power.  This  reduces  the  separation  distance  to  15  percent  of  the 
required  distance  (minimum  15  centimeters). 

8.37.  Countermeasure  --  RED  Signal  Ground  Wire  and  BLACK  Wire  Line  Separation. 

8.37.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  around  RED  signal  ground 
wires  as  a  result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromag¬ 
netic  wave;  in  other  words,  RED  signal  ground  wires  act  as  transmitting  antennas.  The  problem  is 
BLACK  wire  lines  can  act  as  receiving  antennas  and  pick  up  the  compromising  emanations. 

8.37.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  signal  ground  wires 
from  BLACK  wire  lines. 

8.37.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BLACK  wire  lines 
picking  up  compromising  emanations  from  RED  signal  ground  wires  and  escaping  the  inspectable 
space  on  BLACK  wire  lines. 

8.37.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BLACK  wire  lines,  are  controlled.  Normally,  this  countermeasure  is  not  needed  if  the 
line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  bound¬ 
ary  of  the  inspectable  space  is  greater  than  2,000  meters  or  if  the  BLACK  lines  are  fiber  optic. 

8.37.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  signal  ground  wires  away  from  the 
BLACK  wire  lines  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.37.6.  Alternatives.  The  alternatives  to  fully  separating  RED  signal  ground  wires  from  BLACK  wire 
lines,  as  required  in  the  applicable  countermeasures  review  attachment,  are: 

8.37.6.1.  Use  a  BLACK  wire  line  isolation  countermeasure.  This  reduces  the  separation  distance 
to  15  percent  of  the  required  distance  (minimum  15  centimeters),  or. 
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8.37.6.2.  Shield  the  BLACK  wire  lines  to  prevent  them  from  picking  up  compromising  emana¬ 
tions.  This  reduces  the  separation  distance  to  15  percent  of  the  required  distance  (minimum  15 
centimeters). 

8.38.  Countermeasure  --  RED  Signal  Ground  Wire  and  BLACK  Power  Line  Separation. 

8.38.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  around  RED  signal  ground 
wires  as  a  result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromag¬ 
netic  wave;  in  other  words,  RED  signal  ground  wires  act  as  transmitting  antennas.  The  problem  is 
BEACK  power  lines  can  act  as  receiving  antennas  and  pick  up  the  compromising  emanations. 

8.38.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  signal  ground  wires 
from  BEACK  power  lines. 

8.38.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BEACK  power  lines 
picking  up  compromising  emanations  from  RED  signal  ground  wires  and  escaping  the  inspectable 
space  on  BEACK  power  lines  and,  to  a  lesser  degree,  BEACK  wire  lines  connected  to  BEACK  equip¬ 
ment. 

8.38.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BEACK  power  lines  and  BEACK  wire  lines,  are  controlled.  Normally,  this  counter¬ 
measure  is  not  needed  if: 

8.38.4.1.  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt- amperes  and  at  least  10,000  volts  potential,  and, 

8.38.4.2.  The  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BEACK  lines  are 
fiber  optic. 

8.38.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  signal  ground  wires  away  from  the 
BEACK  power  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.38.6.  Alternatives.  The  alternatives  to  fully  separating  RED  signal  ground  wires  from  BEACK 
power  lines,  as  required  in  the  applicable  countermeasures  review  attachment,  are: 

8.38.6.1.  Eilter  BEACK  power  lines.  This  reduces  the  separation  distance  to  15  percent  of  the 
required  distance  (minimum  15  centimeters),  and, 

8.38.6.2.  Use  a  BEACK  wire  line  isolation  countermeasure. 

8.39.  Countermeasure  --  RED  Signal  Ground  Wire  and  BLACK  Signal  Ground  Wire  Separation. 

8.39.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  around  RED  signal  ground 
wires  as  a  result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromag¬ 
netic  wave;  in  other  words,  RED  signal  ground  wires  act  as  transmitting  antennas.  BEACK  signal 
ground  wires  can  act  as  receiving  antennas  and  pick  up  the  compromising  emanations.  The  problem  is 
BEACK  signal  ground  wires  can  pick  up  compromising  emanations.  The  picked  up  compromising 
emanations  can  escape  in  three  ways: 

8.39.1.1.  Conducting  them  to  the  shields  on  BEACK  lines  where  they  can  be  conducted  to 
BEACK  equipment  and  escape  the  inspectable  space  on  the  BEACK  wire  lines  and  BEACK 
power  lines. 
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8.39.1.2.  Conducting  them  to  the  shields  on  BLACK  lines  where  they  can  be  impressed  on  the 
BLACK  wire  lines  and  escape  the  inspectable  space  on  the  BLACK  wire  lines. 

8.39.1.3.  Conducting  them  back  through  the  filters  on  BLACK  wire  lines  where  they  ean  be 
impressed  on  the  BLACK  wire  lines  and  escape  the  inspectable  space  on  the  BLACK  wire  lines. 

8.39.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  RED  signal  ground  wires 
from  BLACK  signal  ground  wires. 

8.39.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BLACK  signal 
ground  wires  picking  up  compromising  emanations  from  RED  signal  ground  wires  and  escaping  the 
inspectable  space  on  BEACK  wire  lines  and,  to  a  lesser  degree,  BEACK  power  lines. 

8.39.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BEACK  wire  lines  and  BEACK  power  lines,  are  controlled.  Normally,  this  counter¬ 
measure  is  not  needed  if: 

8.39.4. 1 .  The  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspeetable  space  is  greater  than  1,000  meters  or  the  BEACK  lines  are 
fiber  optic,  and, 

8.39.4.2.  The  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where 
the  average  load  exeeeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 

8.39.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  signal  ground  wires  away  from  the 
BEACK  signal  ground  wires  by  the  distance  specified  in  the  applicable  countermeasures  review 
attaehment. 

8.39.6.  Alternatives.  The  alternatives  to  fully  separating  RED  signal  ground  wires  from  BEACK  sig¬ 
nal  ground  wires,  as  required  in  the  applicable  countermeasures  review  attachment,  are: 

8.39.6.1.  Use  a  BEACK  wire  line  isolation  countermeasure,  and, 

8.39.6.2.  Eilter  the  BEACK  power  lines. 

8.40.  Countermeasure  --  RED  Signal  Ground  Wire  and  Fortuitous  Conductor  Separation. 

8.40.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  around  RED  signal  ground 
wires  as  a  result  of  eurrent  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  eleetromag- 
netic  wave;  in  other  words,  the  RED  signal  ground  wire  acts  as  a  transmitting  antenna.  Eortuitous  con¬ 
ductors  can  act  as  receiving  antennas  and  pick  up  the  compromising  emanations.  The  problem  is 
fortuitous  conductors  can  leave  the  inspectable  space  allowing  compromising  emanations  to  escape 
control.  An  additional  problem  is,  since  fortuitous  conductors  can  run  parallel  to  BEACK  wire  lines 
and  BEACK  power  lines,  compromising  emanations  can  get  coupled  to  them  and  leave  the  inspeet¬ 
able  spaee  if  the  BEACK  wire  lines  or  BEACK  power  lines  leave  the  inspeetable  space. 

8.40.2.  What  the  Countermeasure  Is.  The  eountermeasure  is  to  separate  RED  signal  ground  wires 
from  fortuitous  conductors. 

8.40.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  fortuitous  conductors 
picking  up  compromising  emanations  from  RED  signal  ground  wires  and  escaping  the  inspeetable 
space  on  the  fortuitous  eonductors,  BEACK  wire  lines,  or  BEACK  power  lines. 
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8.40.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  fortuitous  conductors,  BLACK  wire  lines,  and  BLACK  power  lines,  are  controlled. 
Normally,  this  countermeasure  is  not  needed  if: 

8.40.4.1.  Fortuitous  conductors  are  contained  within  the  inspectable  space,  and, 

8.40.4.2.  The  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  250  meters  or  the  BLACK  lines  are 
fiber  optic,  and, 

8.40.4.3.  The  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where 
the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 

8.40.5.  How  To  Apply  the  Countermeasure.  Move  the  RED  signal  ground  wires  away  from  the  fortu¬ 
itous  conductors  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.40.6.  Alternatives.  The  alternatives  to  fully  separating  RED  signal  ground  wires  from  fortuitous 
conductors,  as  required  in  the  applicable  countermeasures  review  attachment,  are: 

8.40.6.1.  Install  nonconductive  breaks  in  all  fortuitous  conductors  at  the  boundary  of  the  inspect¬ 
able  space,  and, 

8.40.6.2.  Separate  the  BEACK  wire  lines  from  BEACK  power  lines  by  the  distance  specified  in 
the  applicable  countermeasures  review  attachment,  or, 

8.40.6.3.  Shield  the  BEACK  wire  lines  and  BEACK  power  lines.  This  reduces  the  separation  dis¬ 
tance  to  5  percent  of  the  required  distance  (minimum  5  centimeters). 

8.41.  Countermeasure  --  BLACK  Signal  Ground  Wire  and  BLACK  Equipment  Separation. 

8.41.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  around  BLACK  signal  ground 
wires  as  a  result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromag¬ 
netic  wave;  in  other  words,  BLACK  signal  ground  wires  act  as  transmitting  antennas.  The  wires, 
traces,  frame,  and  covers  of  BLACK  equipment  can  act  as  receiving  antennas  and  pick  up  the  compro¬ 
mising  emanations.  The  problem  is  if  compromising  emanations  are  picked  up  by  BLACK  equip¬ 
ment,  they  can  escape  on  BLACK  wire  lines  connected  to  the  BLACK  equipment  and  on  the  BLACK 
power  cord  connected  to  the  BLACK  equipment. 

8.41.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  BLACK  signal  ground  wires 
from  BLACK  equipment. 

8.41.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BLACK  equipment 
picking  up  compromising  emanations  from  BLACK  signal  ground  wires  and  escaping  the  inspectable 
space  on  BLACK  wire  lines  or  BLACK  power  lines  connected  to  the  BLACK  equipment. 

8.41.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BLACK  wire  lines  and  BLACK  power  lines,  are  controlled.  Normally,  this  counter¬ 
measure  is  not  needed  if: 

8.41 .4. 1 .  The  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are 
fiber  optic,  and. 
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8.41.4.2.  The  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where 
the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 

8.41.5.  How  To  Apply  the  Countermeasure.  Move  the  BLACK  signal  ground  wires  away  from  the 
BLACK  equipment  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 
Traditionally,  under  ideal  conditions,  areas  were  established  in  a  facility  for  the  placement  of  RED 
equipment  separate  and  unique  from  areas  with  BLACK  equipment.  However,  today,  most  classified 
information  is  processed  in  an  office  environment  but  achieving  and  maintaining  the  separation  is  still 
required.  If  data  from  an  EMSEC  test  determines  that  a  hazard  exists,  a  countermeasure  to  consider  is 
to  increase  the  physical  separation  distance.  A  further  problem  is  offices  are  rearranged  from  time  to 
time  that  can  lead  to  a  natural  laxness  where  the  separation  requirements  are  forgotten. 

8.41.6.  Alternatives.  The  alternatives  to  fully  separating  BEACK  signal  ground  wires  from  BEACK 
equipment,  as  required  in  the  applicable  countermeasures  review  attachment,  are: 

8.41.6.1.  Use  a  BEACK  wire  line  isolation  countermeasure.  This  reduces  the  separation  distance 
to  15  percent  of  the  required  distance  (minimum  15  centimeters),  and, 

8.41.6.2.  Eilter  the  BEACK  power.  This  reduces  the  separation  distance  to  15  percent  of  the 
required  distance  (minimum  15  centimeters). 

8.42.  Countermeasure  --  BLACK  Signal  Ground  Wire  and  BLACK  Wire  Line  Separation. 

8.42.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  around  BLACK  signal  ground 
wires  as  a  result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromag¬ 
netic  wave;  in  other  words,  BLACK  signal  ground  wires  act  as  transmitting  antennas.  The  problem  is 
BLACK  wire  lines  can  act  as  receiving  antennas  and  pick  up  the  compromising  emanations. 

8.42.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  BLACK  signal  ground  wires 
from  BLACK  wire  lines. 

8.42.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BLACK  wire  lines 
picking  up  compromising  emanations  from  BLACK  signal  ground  wires  and  escaping  the  inspectable 
space  on  BLACK  wire  lines. 

8.42.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BLACK  wire  lines,  are  controlled.  Normally,  this  countermeasure  is  not  needed  if  the 
line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  bound¬ 
ary  of  the  inspectable  space  is  greater  than  2,000  meters  or  if  the  BLACK  lines  are  fiber  optic. 

8.42.5.  How  To  Apply  the  Countermeasure.  Move  the  BLACK  signal  ground  wires  away  from  the 
BLACK  wire  lines  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.42.6.  Alternatives.  The  alternatives  to  fully  separating  BLACK  signal  ground  wires  from  BLACK 
wire  lines,  as  required  in  the  applicable  countermeasures  review  attachment,  are: 

8.42.6.1.  Use  a  BLACK  wire  line  isolation  countermeasure.  This  reduces  the  separation  distance 
to  15  percent  of  the  required  distance  (minimum  15  centimeters),  or, 

8.42.6.2.  Shield  the  BLACK  wire  lines  to  prevent  them  from  picking  up  compromising  emana¬ 
tions.  This  reduces  the  separation  distance  to  15  percent  of  the  required  distance  (minimum  15 
centimeters). 
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8.43.  Countermeasure  --  BLACK  Signal  Ground  Wire  and  BLACK  Power  Line  Separation. 

8.43.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  around  BLACK  signal  ground 
wires  as  a  result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromag¬ 
netic  wave;  in  other  words,  BLACK  signal  ground  wires  act  as  transmitting  antennas.  The  problem  is 
BLACK  power  lines  can  act  as  receiving  antennas  and  pick  up  the  compromising  emanations. 

8.43.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  BLACK  signal  ground  wires 
from  BLACK  power  lines. 

8.43.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  BLACK  power  lines 
picking  up  compromising  emanations  from  BLACK  signal  ground  wires  and  escaping  the  inspectable 
space  on  BLACK  power  lines  and,  to  a  lesser  degree,  BLACK  wire  lines  connected  to  BLACK  equip¬ 
ment. 

8.43.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BLACK  power  lines  and  BLACK  wire  lines,  are  controlled.  Normally,  this  counter¬ 
measure  is  not  needed  if: 

8.43.4.1.  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt- amperes  and  at  least  10,000  volts  potential,  and, 

8.43.4.2.  The  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are 
fiber  optic. 

8.43.5.  How  To  Apply  the  Countermeasure.  Move  the  BLACK  signal  ground  wires  away  from  the 
BLACK  power  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.43.6.  Alternatives.  The  alternatives  to  fully  separating  BLACK  signal  ground  wires  from  BLACK 
power  lines,  as  required  in  the  applicable  countermeasures  review  attachment,  are: 

8.43.6.1.  Filter  BLACK  power  lines.  This  reduces  the  separation  distance  to  15  percent  of  the 
required  distance  (minimum  15  centimeters),  and, 

8.43.6.2.  Use  a  BLACK  wire  line  isolation  countermeasure. 

8.44.  Countermeasure  --  BLACK  Signal  Ground  Wire  and  Fortuitous  Conductor  Separation. 

8.44.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  around  BLACK  signal  ground 
wires  as  a  result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromag¬ 
netic  wave;  in  other  words,  the  BLACK  signal  ground  wire  acts  as  a  transmitting  antenna.  Fortuitous 
conductors  can  act  as  receiving  antennas  and  pick  up  the  compromising  emanations.  The  problem  is 
fortuitous  conductors  can  leave  the  inspectable  space  allowing  compromising  emanations  to  escape 
control.  An  additional  problem  is,  since  fortuitous  conductors  can  run  parallel  to  BFACK  wire  lines 
and  BFACK  power  lines,  compromising  emanations  can  get  coupled  to  them  and  leave  the  inspect¬ 
able  space  if  the  BFACK  wire  lines  or  BFACK  power  lines  leave  the  inspectable  space. 

8.44.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  BFACK  signal  ground  wires 
from  fortuitous  conductors. 
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8.44.3.  What  the  Countermeasure  Does.  Separation  decreases  the  probability  of  fortuitous  conductors 
picking  up  compromising  emanations  from  BLACK  signal  ground  wires  and  escaping  the  inspectable 
space  on  the  fortuitous  conductors,  BLACK  wire  lines,  or  BLACK  power  lines. 

8.44.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  fortuitous  conductors,  BLACK  wire  lines,  and  BLACK  power  lines,  are  controlled. 
Normally,  this  countermeasure  is  not  needed  if: 

8.44.4.1.  Fortuitous  conductors  are  contained  within  the  inspectable  space,  and, 

8.44.4.2.  The  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  250  meters  or  the  BLACK  lines  are 
fiber  optic,  and, 

8.44.4.3.  The  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where 
the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 

8.44.5.  How  To  Apply  the  Countermeasure.  Move  the  BLACK  signal  ground  wires  away  from  the 
fortuitous  conductors  by  the  distance  specified  in  the  applicable  countermeasures  review  attachment. 

8.44.6.  Alternatives.  The  alternatives  to  fully  separating  BLACK  signal  ground  wires  from  fortuitous 
conductors,  as  required  in  the  applicable  countermeasures  review  attachment,  are: 

8.44.6.1.  Install  nonconductive  breaks  in  all  fortuitous  conductors  at  the  boundary  of  the  inspect¬ 
able  space,  and, 

8.44.6.2.  Separate  the  BLACK  wire  lines  from  BLACK  power  lines  by  the  distance  specified  in 
the  applicable  countermeasures  review  attachment,  or, 

8.44.6.3.  Shield  the  BLACK  wire  lines  and  BLACK  power  lines.  This  reduces  the  separation  dis¬ 
tance  to  5  percent  of  the  required  distance  (minimum  5  centimeters). 

8.45.  Ground  Checks.  The  base  civil  engineer  makes  ground  checks,  in  support  of  EMSEC,  as  speci¬ 
fied  in  AEI  32-1065,  Grounding  Systems.  When  installing  a  new  communications  system,  make  ground 
resistivity  checks  every  3  months  for  1  year  and  then  rechecks  every  21  months.  The  resistance  to  ground 
is  less  than  10  ohms. 

8.46.  Fortuitous  Conductors.  Fortuitous  conductors  are  metallic  objects  that  normally  do  not  have  a 
direct  mission  function.  Fortuitous  conductors  are  such  things  as  heating  and  air  conditioning  ducts,  water 
and  gas  pipes,  and  fire  alarm  and  suppression  systems.  Fortuitous  conductors  can  be  divided  into  three 
general  types. 

8.46.1.  Alarm  Systems.  Many  facilities  employ  alarm  systems  to  detect  and  alert  personnel  of 
life-threatening  or  security-threatening  situations.  These  systems  use  metallic  conductors  to  connect 
passive  or  active  sensors  to  an  enunciator  panel.  It  is  permitted  to  request  an  EMSEC  field  test  of  the 
alarm  system  to  determine  its  susceptibility  to  radiated  emanations,  and  identify  the  appropriate  cor¬ 
rective  measures  to  apply. 

8.46.2.  Building  Utilities.  Building  utilities  pose  problems  in  facilities  since  most  are  constructed  of 
metallic  materials  and  thus  are  susceptible  to  picking  up  radiated  emanations. 

8.46.2.1.  Utilities  include  heating,  ventilating,  and  air  conditioning  systems,  and  water  and  gas 
pipes. 
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8.46.2.2.  The  Occupational  Safety  and  Health  Act  of  1970  (P.L.  91-596)  and  local  building  codes 
require  bonding  together  into  one  electrically  contiguous  system,  using  guidance  in  the  National 
Electric  Code,  all  parts  of  any  structure  that  might  become  energized,  whether  intended  to  do  so  or 
not.  Therefore,  all  plumbing  and  duct  work  are  electrically  bonded  to  the  structural  members  and 
further  bonded  to  the  life-saving  ground  system  and  to  the  equipotential  plane.  In  this  manner, 
multiple  and  direct  low-impedance  paths  will  exist  to  return  energy  to  the  source. 

8.46.3.  Facility  Construction.  Many  facilities  use  metallic  studs  in  the  construction  of  interior  walls. 
In  most  cases,  these  are  not  a  problem.  However,  if  the  studs  are  electrically  connected  (metallic  con¬ 
nection)  to  other  walls  of  similar  construction  and  transit  the  perimeter  of  the  inspectable  space,  then 
compromising  emanations  could  escape  by  these  fortuitous  conductors. 

8.47.  Countermeasure  --  Fortuitous  Conductor  Isolation. 

8.47.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  in  RED  equipment  as  a  result 
of  state  changes  in  electronic  circuits  and  current  flow  in  traces  and  wires.  Also,  compromising  ema¬ 
nations  are  produced  around  RED  wire  lines  as  a  result  of  current  flow  in  the  wire  generating  a  mag¬ 
netic  field  that  produces  an  electromagnetic  wave;  in  other  words,  the  RED  wire  line  acts  as  a 
transmitting  antenna.  Further,  when  equipment  processes  information,  it  can  create  noise  that  may 
appear  on  the  equipment’s  power  cord;  these  may  be  compromising  emanations  in  the  case  of  RED 
equipment.  Fortuitous  conductors  can  act  as  receiving  antennas  and  pick  up  compromising  emana¬ 
tions  from  nearby  RED  equipment,  RED  lines,  and  RED  power  lines.  The  problem  is  compromising 
emanations  may  be  conducted  on  fortuitous  conductors  that  exit  the  inspectable  space. 

8.47.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  isolate  a  fortuitous  conductor  that 
exits  the  inspectable  space. 

8.47.3.  What  the  Countermeasure  Does.  Isolating  the  fortuitous  conductor  contains  compromising 
emanations  within  the  inspectable  space  by  breaking  the  conducting  path. 

8.47.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  fortuitous  conductors,  BEACK  wire  lines,  and  BEACK  power  lines  are  controlled. 
Normally,  this  countermeasure  is  not  needed  if: 

8.47.4.1.  Fortuitous  conductors  do  not  exit  the  inspectable  space,  and, 

8.47.4.2.  The  line  distance  of  the  BEACK  wire  lines  connected  to  BEACK  equipment  from  the 
building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than 
250  meters  or  the  BEACK  lines  are  fiber  optic,  and, 

8.47.4.3.  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 

8.47.5.  How  To  Apply  the  Countermeasure.  The  basic  treatment  to  isolate  fortuitous  conductors  is  to 
break  the  electrical  (metallic)  connection.  Use  it  at  the  boundary  or  perimeter  of  the  inspectable  space. 
If  the  nonconductive  break  is  placed  within  the  ERTZ  of  RED  equipment,  there  is  a  chance  to  recon¬ 
taminate  the  fortuitous  conductor.  There  are  situations  where  the  emanation  on  the  fortuitous  conduc¬ 
tor  is  a  radio  frequency  (radio  frequency)  signal.  When  a  fortuitous  conductor  is  a  hollow  metallic 
conduit  or  pipe,  the  conduit  or  pipe  can  act  like  a  waveguide.  This  means  that  when  the  conduit  or  pipe 
stops,  the  end  acts  like  a  feed-horn  antenna  and  propagates  the  radio  frequency  signal  into  free  space 
in  the  direction  the  conduit  is  pointed.  This  energy  will  cross  the  nonconductive  break  and  recontami- 
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nate  the  fortuitous  conductor.  If  this  situation  is  probable,  then  offset  the  continuation  of  the  conduit  or 
pipe  such  that  the  two  ends  are  not  in  line  with  each  other. 

8.47.6.  Alternatives.  The  alternatives  to  isolating  fortuitous  conductors  are: 

8.47.6.1.  Increase  the  separation  distance  for  RED  equipment  and  fortuitous  conductors,  or, 

8.47.6.2.  Use  RED  equipment  where  the  strength  of  the  compromising  emanations  has  been 
reduced.  This  normally  means  TEMPEST-certified  equipment,  or, 

8.47.6.3.  Shield  the  RED  equipment  to  reduce  compromising  emanations  by  using  the  encapsula¬ 
tion  technique.  If  there  are  several  items  of  RED  equipment  that  need  separation  from  several 
items  of  BEACK  equipment,  an  alternative  to  consider  is  using  a  shielded  enclosure,  and, 

8.47.6.4.  Shield  the  BEACK  wire  lines,  or, 

8.47.6.5.  Use  a  BEACK  wire  line  isolation  countermeasure,  and, 

8.47.6.6.  Shield  the  BEACK  power  lines,  or, 

8.47.6.7.  Eilter  the  BEACK  power  lines. 

8.48.  Distribution  Facilities.  In  a  facility  that  processes  classified  information,  signal  wire  lines,  power 
lines,  and  signal  ground  wires  are  divided  into  two  groups,  RED  and  BEACK.  Those  signal  wire  lines  that 
carry  classified  information,  power  circuits  used  exclusively  by  RED  processors,  and  signal  grounds  for 
RED  equipment  and  the  shields  of  RED  wire  lines  are  labeled  RED.  Those  that  do  not  handle  classified 
information  are  labeled  BEACK.  Basically,  distribution  facilities  are  a  form  of  plumbing.  They  consist  of 
pipe  in  the  form  of  emt,  iron  pipe,  or  metallic  ducting  (a  square  pipe). 

8.48. 1 .  A  distribution  facility  provides  a  convenient  method  for  separating  and  controlling  the  routing 
of  signal,  power,  and  ground  cables.  Such  routing  ensures  that  RED  and  BEACK  cables  are  properly 
separated  and  not  mixed  by  controlling  access  to  the  route. 

8.48.2.  Properly  installed,  a  distribution  facility  may  shield  the  cables  thereby  either  reducing 
free-space  radiation  of  compromising  emanations  from  RED  cables  or  preventing  BEACK  cables 
from  picking  up  radiated  compromising  emanations. 

8.48.3.  In  a  facility  where  all  cables  are  in  distribution  facilities,  there  will  be  at  least  five  distribution 
facilities;  RED  signal,  BEACK  signal,  RED  power,  BEACK  power,  and  BEACK  signal  ground.  RED 
signal  ground  may  be  run  with  RED  wire  lines. 

8.49.  Countermeasure  --  Distribution  Facility  Installation. 

8.49. 1 .  What  the  Problem  Is.  In  some  facilities,  there  is  a  plethora  of  cables,  wires,  signal  lines,  power 
lines,  signal  grounds,  and  fortuitous  conductors.  All  the  RED  metallic  conductors  emanate  compro¬ 
mising  emanations.  The  problem  is  BEACK  wire  lines,  BEACK  power  lines,  BEACK  signal  grounds, 
and  fortuitous  conductors  can  pick  up  these  compromising  emanations  and  carry  them  beyond  the 
inspectable  space  if  not  properly  separated. 

8.49.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  install  some  or  all  RED  lines,  RED 
power  lines,  BEACK  wire  lines,  BEACK  power  lines,  and  BEACK  signal  grounds  in  distribution 
facilities. 
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8.49.3.  What  the  Countermeasure  Does.  Installing  some  or  all  RED  lines,  RED  power  lines,  BEACK 
wire  lines,  BEACK  power  lines,  and  BEACK  signal  grounds  in  distribution  facilities  achieves  the 
proper  separation  and  can  shield,  if  the  distribution  facilities  are  properly  constructed,  RED  lines, 
RED  power  lines,  BEACK  wire  lines,  BEACK  power  lines,  and  BEACK  signal  grounds. 

8.49.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BEACK  wire  lines,  BEACK  power  lines,  BEACK  signal  ground,  and  fortuitous  con¬ 
ductors,  are  controlled.  Normally,  this  countermeasure  is  not  needed  if: 

8.49.4.1.  All  RED  wire  lines,  RED  power  lines,  and  RED  signal  ground  wires  are  shielded,  or, 

8.49.4.2.  Eortuitous  conductors  are  contained  within  the  inspectable  space,  or, 

8.49.4.3.  All  fortuitous  conductors  are  separated  from  RED  wire  lines,  RED  power  lines,  and 
RED  signal  ground  by  the  distance  specified  in  the  applicable  countermeasure  review  attachment, 
or, 

8.49.4.4.  All  fortuitous  conductors  are  isolated  with  a  nonconductive  break  at  the  boundary  of  the 
inspectable  space,  and, 

8.49.4.5.  All  BEACK  wire  lines  are  separated  from  RED  wire  lines,  RED  power  lines,  and  RED 
signal  ground  by  the  distance  specified  in  the  applicable  countermeasure  review  attachment,  or, 

8.49.4.6.  All  BEACK  wire  lines  are  shielded,  or, 

8.49.4.7.  A  BEACK  wire  line  isolation  countermeasure  is  used,  or, 

8.49.4.8.  The  line  distance  of  BEACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  2,000  meters  or  the  BEACK  lines  are 
fiber  optic,  and, 

8.49.4.9.  All  BEACK  power  lines  are  separated  from  RED  wire  lines,  RED  power  lines,  and  RED 
signal  ground  by  the  distance  specified  in  the  applicable  countermeasure  review  attachment,  or, 

8.49.4.10.  All  BEACK  power  lines  are  shielded,  or, 

8.49.4. 1 1 .  All  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where 
the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential,  or, 

8.49.4.12.  All  BEACK  power  lines  are  filtered,  and, 

8.49.4.13.  All  BEACK  signal  ground  wires  are  separated  from  RED  wire  lines,  RED  power  lines, 
RED  signal  ground,  BEACK  wire  lines,  and  BEACK  power  lines  by  the  distance  specified  in  the 
applicable  countermeasure  review  attachment,  or, 

8.49.4.14.  All  BEACK  signal  ground  wires  are  insulated  and  run  in  emt  grounded  at  the  earth 
electrode  subsystem. 

8.49.5.  How  To  Apply  the  Countermeasure. 

8.49.5.1.  Design  Objectives.  The  signal  distribution  design  accomplishes  three  primary  objec¬ 
tives:  (1)  provides  an  orderly  scheme  to  route  cables  among  and  between  equipment;  (2)  provides 
accountability  for  all  cables;  (3)  prevents  RED  cables  from  becoming  mixed  with  or  inadvertently 
connected  to  any  BEACK  cables. 
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8.49.5.2.  General  Installation  Guidelines.  Contain  RED  distribution  facilities  within  the  CAA.  If 
the  distribution  facility  is  meant  to  provide  shielding,  then  the  disconnect  plug  used  with  flexible 
ferrous  conduit  must  be  a  shielded  type  or  ensures  the  shield  of  the  circuit  cabling  (shielded  cable) 
is  carried  on  a  pin  through  the  plug.  When  the  shield  is  carried  on  a  pin,  the  connector  should  pro¬ 
vide  complete  electrical  isolation  between  the  cable  shield  and  plug  case.  Maintain  the  electrical 
isolation  between  the  cable  shield  and  connector  case  during  field  assembly. 

8.49.5.3.  Separation  Requirements.  Separate  RED  and  BEACK  distribution  facilities  according 
to  the  applicable  countermeasures  review  attachment.  Use  caution  when  installing  a  metallic  RED 
distribution  facility.  The  main  problem  occurs  when  suspending  the  distribution  facility  from  the 
facility  structure.  Any  metallic  connection  between  the  distribution  facility  and  the  facility  struc¬ 
ture  provides  a  path  for  compromising  emanations  on  the  distribution  facility  to  escape  the 
inspectable  space  via  fortuitous  conductors  of  the  facility  structure.  Disregard  this  concern  if  the 
facility  is  constructed  using  the  latest  guidance  for  bonding  the  structure,  pipes,  ducts,  etc.,  to  form 
many  paths  to  ground,  or  the  building  is  constructed  as  an  equipotential  ground  plane. 

8.49.5.4.  Marking  Distribution  Eacilities.  The  requirement  to  mark  distribution  facilities  in  CAAs 
is  a  COMSEC  requirement.  This  requirement  helps  meet  the  requirement  to  control  classified 
information. 

8.49.5.4.1.  Mark  all  RED  distribution  facilities  except  conduit  carrying  a  RED  signal  ground 
feeder  external  to  the  building  within  the  inspectable  space.  Use  a  1-inch  wide  strip  of  red  tape 
or  red  paint  at  intervals  of  approximately  1-1/2  meters. 

8.49.5.4.2.  Where  BEACK  components  are  very  few  compared  to  the  number  of  RED  com¬ 
ponents,  it  is  permitted  to  mark  BEACK  components  instead  of  RED  components.  Mark  all 
BEACK  distribution  facilities  except  conduit  carrying  a  BEACK  signal  ground  feeder  external 
to  the  building  within  the  inspectable  space.  Use  a  1-inch  wide  strip  of  black  tape  or  black 
paint  at  intervals  of  approximately  1-1/2  meters.  On  black  colored  components,  use  another 
color,  such  as  white,  to  accentuate  the  black  tape  or  paint. 

8.49.5.5.  Viewing  RED  Distribution  Eacilities.  Expose  to  view,  never  hide,  RED  distribution 
facilities  and  wire  lines  (signal,  power,  and  ground)  except  when  passing  through  walls,  floors,  or 
ceilings  to  other  spaces  within  the  inspectable  space.  Make  each  opening  through  which  distribu¬ 
tion  facilities  and  wire  lines  pass  large  and  accessible  enough  to  permit  easy  access  and  inspection. 
If  hiding  distribution  facilities  and  wire  lines  is  unavoidable,  then  the  competent  engineering 
authority  must  specifically  require  it,  and  the  cognizant  security  authority  must  approve  it.  It  may 
be  necessary  to  provide  appropriate  alarm  and  penetration  protection  for  hidden  wire  lines  and  dis¬ 
tribution  facilities.  Technically  qualified  user  personnel  must  inspect  hidden  distribution  facilities 
and  wire  lines  at  initial  installation,  during  subsequent  changes,  and  daily  for  TOP  SECRET, 
weekly  for  SECRET,  and  monthly  for  CONEIDENTIAE  at  irregular  intervals. 

8.49.5.6.  Interconnect  Eacilities.  Some  facilities  require  an  interconnect  medium  to  connect  the 
terminal  equipment  to  the  encryption  device,  the  encryption  device  to  the  modem,  and  the  modem 
to  the  line  or  carrier  equipment.  This  interconnect  medium  is  usually  a  technical  control  or 
patch-and-test  facility.  The  technical  control  or  patch-and-test  facility  consists  of  patching  and  dis¬ 
tribution  equipment. 

8.49.5.6.1.  Patching  Equipment.  The  most  common  form  of  patching  equipment  is  a  series  of 
jack  fields  wired  in  the  normal-through  configuration,  which  permits  connecting  equipment 
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through  all  elements  to  the  line  or  carrier  equipment.  Patch  cords  allow  the  use  of  spare  equip¬ 
ment  or  cable  pairs  for  the  purpose  of  performing  routine  maintenance  or  to  prevent  downtime 
due  to  equipment  or  wiring  malfunctions.  When  mounting  jack  fields  on  a  plate  for  installation 
in  a  rack,  they  are  called  patch  panels.  Some  coaxial  patch  panels  may  have  all  of  the  outer 
conductors  (typically,  the  shields)  tied  together.  That  makes  them  common  with  the  panel  and, 
therefore,  common  to  the  green- wire  ground.  Isolate  all  feed-through  shields  from  the  chassis. 

8.49.5.6.1.1.  When  using  patching  equipment  in  a  facility  that  processes  both  RED  and 
BLACK  information,  use  separate  RED  and  BLACK  jack  fields.  Install  the  RED  and 
BLACK  jack  fields  in  separate  racks  or  cabinets.  Separate  the  RED  jack  fields  from  the 
BLACK  jack  fields  by  a  distance  that  would  eliminate  the  possibility  of  connecting  a  stan¬ 
dard  patch  cord  between  RED  and  BLACK  patches.  If  this  distance  is  not  achievable,  then 
make  each  patch  panel  unique  by  using  different  styled  jacks  and  plugs  for  the  RED  and 
BLACK  jack  fields.  Separate  the  cabinets  or  racks  from  RED  and  BLACK  equipment 
according  to  the  applicable  countermeasures  review  attachment. 

8.49.5.6.1.2.  Contain  technical  control  and  patch-and-test  facilities  within  a  CAA.  This 
does  not  mean  they  are  always  in  the  RED  equipment  area. 

8.49.5.6.2.  Distribution  Equipment  (Wire  Closets).  Wire  closets  typically  are  equipment  cab¬ 
inets  or  rooms  that  are  designed  so  cables  can  be  hardwire  interconnected  between  equipment. 
Equip  wire  closets  with  connector  blocks  to  provide  interconnectivity  of  terminal  equipment, 
encryption  devices,  technical  control  or  patch-and-test  facility,  and  line  or  line-conditioning 
equipment.  Designate  distribution  equipment  with  separate  RED  and  BLACK  connector 
blocks  to  prevent  cross  connecting  the  RED  and  BLACK  wire  lines.  Separate  according  to  the 
applicable  countermeasures  review  attachment. 

8.49.5.7.  Power  Distribution  Eacilities.  The  power  requirements  of  any  facility  are  divided  into 
two  groups;  power  for  the  mission  equipment  and  power  for  the  supporting  services.  Supporting 
services  include  such  things  as  lighting,  heating,  ventilation,  and  air  conditioning.  In  a  facility  pro¬ 
cessing  plain-text  classified  information,  the  mission  power  can  be  further  divided  into  RED 
power  and  BLACK  power,  in  separate  distribution  facilities. 

8.49.5.7.1.  General  Installation  Requirements.  All  the  power  distribution  schemes  must  con¬ 
form  to  the  life-safety  provisions  of  the  Occupational,  Safety,  and  Health  Act  of  1970  (PL. 
91-596),  the  National  Electric  Code,  and  local  building  codes. 

8.49.5.7.2.  Equipment  Isolation.  Design  RED  power  distribution  such  that  it  is  difficult  to 
connect  BLACK  equipment  or  utility  equipment  to  it.  By  providing  a  separate  service  feeder 
for  the  sensitive  equipment  and  controlling  its  distribution,  the  opportunity  for  an  adversary  to 
gain  access  to  those  lines  is  reduced.  With  respect  to  AC  power,  it  is  possible  to  recover 
plain-text  information  through  power  line  conduction. 

8.49.5.8.  RED  Signal  Ground  Distribution  Eacility.  A  separate  distribution  facility  for  a  RED  sig¬ 
nal  ground  is  not  required.  It  is  permitted  to  run  it  in  the  RED  signal  distribution  facility.  It  is  not 
a  good  engineering  practice  to  run  the  RED  signal  ground  wire  in  the  RED  power  distribution 
facility. 

8.49.5.9.  BLACK  Signal  Ground  Distribution  Eacility.  Run  the  BLACK  signal  ground  wire  in  its 
own  distribution  facility.  There  are  two  reasons  for  this. 
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8.49.5.9.1.  Filters  are  used  to  strip  conducted  compromising  emanations  from  BLACK  wire 
lines  and  shields  are  used  on  BLACK  wire  lines  to  collect  radiated  compromising  emanations 
and  conduct  them  to  ground  on  the  BLACK  signal  ground  wire.  To  run  the  BLACK  signal 
ground  wire  in  the  BLACK  signal  distribution  facility  could  contaminate  the  BLACK  wire 
lines,  especially  if  some  of  the  BLACK  wire  lines  are  unshielded. 

8.49.5.9.2.  Do  not  run  the  BLACK  signal  ground  wire,  although  contaminated  with  compro¬ 
mising  emanations,  with  the  RED  signal  ground  wire  or  RED  wire  lines.  To  do  so  runs  the  risk 
of  contaminating  BEACK  equipment  with  compromising  emanations.  There  are  a  number  of 
ways  this  may  happen.  One  is  because  some  potential  difference  may  exist  between  RED  and 
BEACK  equipment.  Another  is  a  lower  impedance  path  may  exist  in  such  a  manner  that  com¬ 
promising  emanations  picked  up  by  the  BEACK  signal  ground  wire  from  the  RED  signal 
ground  wire  or  RED  wire  lines  are  conducted  to  the  BEACK  equipment. 

8.49.5.10.  Construction.  Base  the  selection  of  ferrous  or  nonferrous  hardware  on  EMSEC  consid¬ 
erations.  Minimum  standards  for  metallic  hardware  are: 

8.49.5.10.1.  Conduit.  Use  nonferrous  conduit,  that  is,  emt,  as  specified  in  the  latest  version  of 
the  National  Electric  Code,  except  with  the  addition  of  a  noncorrosive  conductive  coating.  Use 
ferrous  conduit  for  nonlow-level  operating  wire  lines.  Eerrous  conduit  is  rigid,  threaded  thick- 
wall  ferrous  pipe  or  ferrous  rigid-sheet  steel  ducting  to  form  a  single  tube. 

8.49.5.10.2.  Conduit  Eittings.  Use  threaded  or  the  compression  type  fittings  for  either  ferrous 
or  nonferrous  metallic  conduit. 

8.49.5.10.3.  Sealing  Requirements.  Threaded  and  compression  type  fittings,  when  properly 
installed,  do  not  require  sealing  by  welding  or  conductive  epoxy  unless  the  distribution  facility 
is  to  meet  a  shielding  requirement.  The  National  Stock  Number  for  conductive  epoxy  is 
8040-00-944-7292. 

8.49.5.10.4.  Painted  or  Unpainted  Metal  Duct.  Eabricate  unpainted  enclosed  metal  duct  such 
that  assembly  techniques  ensure  good  electrical  joints  and  continuous  metal-to-metal  contact. 
It  is  permitted  to  apply  paint  after  the  installation  is  complete.  Prepainted  duct  is  acceptable 
when  duct  is  chosen  as  an  installation  method  and  not  used  to  meet  a  shielding  requirement. 
Do  not  use  prepunched  knockouts  when  using  the  duct  to  meet  a  shielding  requirement. 

8.49.5.10.5.  Boxes.  Enclose  in  metallic  boxes  all  terminal  boxes,  junction  boxes,  and  other 
similar  containers  that  terminate  or  interface  with  the  distribution  facility  and,  where  econom¬ 
ically  feasible,  made  of  ferrous  material.  Do  not  use  prepunched  knockouts  when  using  the 
distribution  facility  to  meet  a  shielding  requirement. 

8.49.5.10.6.  Radio  Erequency  Gasketing.  Radio  frequency  gasketing  must  be  used  on  covers 
(duct  and  boxes)  if  using  the  distribution  facility  to  meet  a  shielding  requirement,  otherwise,  it 
is  elective. 

8.49.5.10.7.  Elexible  Eerrous  Conduit.  Keep  the  use  of  flexible  ferrous  conduit  to  a  minimum. 
Use  is  permitted  to  allow  movement  of  equipment  requiring  frequent  maintenance.  Elexible 
conduit  also  enables  the  installer  to  carry  wiring  to  connections  that  are  impractical  to  accom¬ 
plish  with  rigid  or  emt  conduit.  Use  flexible  conduit  only  at  the  end  of  a  cable  run.  Keep  the 
length  of  flexible  ferrous  conduit  runs  as  short  as  possible  and  do  not  exceed  2  meters  for  each 
run.  Interface  flexible  ferrous  conduit  to  the  distribution  facility  with  a  junction  box.  Equip  the 
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junction  box  with  a  quick  disconnect  termination  to  enable  rapid  removal  of  the  equipment 
from  the  distribution  facility. 

8.49.5.10.8.  Spare  Conductors.  Cabling  within  the  RED  and  BLACK  distribution  systems, 
especially  the  signal  distribution  systems,  will  normally  contain  spare  conductors  for  future 
expansion,  fault  isolation,  or  equipment  wiring  changes.  Terminate  spare  conductors  at  one 
end  to  the  signal  ground  bus  in  the  appropriate  distribution  frames  serving  the  particular  cable 
or  wire  line;  that  is,  ground  spare  RED  conductors  to  the  RED  signal  ground  wire  and  spare 
BLACK  conductors  to  BLACK  signal  ground  wire.  Ground  them  within  the  inspectable 
space. 

8.49.5.10.9.  Unused  Conductors.  Remove  cable  and  wires  no  longer  used  or  needed  as  a 
result  of  renovation  or  installation  of  new  cabling.  Unused  cables  can  become  fortuitous  con¬ 
ductors  picking  up  compromising  emanations  from  a  cable,  wire,  or  free  space  radiation  in  one 
area  and  carrying  them  to  another  area.  If  it  is  not  possible  to  remove  unused  conductors,  then 
tie  them  (bundled)  together,  and  ground  them  within  the  inspectable  space. 

8.49.5.10.10.  Accountability  of  Wires  and  Cables.  Account  completely  for  all  wires  and 
cables  within,  or  passing  through  a  secure  area.  Clearly  mark,  label,  or  tag,  according  to  pur¬ 
pose,  all  wires  and  cables.  Remove  all  unused  wiring.  Ground  spare  wiring  in  cables  within  the 
inspectable  space  and  clearly  mark  as  such. 

8.49.6.  Alternatives.  The  alternatives  to  using  distribution  facilities  are: 

8.49.6.1.  Shield  all  RED  wire  lines,  RED  power  lines,  and  RED  signal  ground  wires,  or, 

8.49.6.2.  Contain  all  fortuitous  conductors  within  the  inspectable  space,  or, 

8.49.6.3.  Separate  all  fortuitous  conductors  from  RED  wire  lines,  RED  power  lines,  and  RED  sig¬ 
nal  ground  wire  by  the  distance  specified  in  the  applicable  countermeasure  review  attachment,  or, 

8.49.6.4.  Isolate  all  fortuitous  conductors  with  a  nonconductive  break  at  the  boundary  of  the 
inspectable,  and, 

8.49.6.5.  Separate  all  BLACK  wire  lines  from  RED  wire  lines,  RED  power  lines,  and  RED  signal 
ground  wire  by  the  distance  specified  in  the  applicable  countermeasure  review  attachment,  or, 

8.49.6.6.  Shield  all  BLACK  wire  lines,  or, 

8.49.6.7.  Use  a  BLACK  wire  line  isolation  countermeasure,  and, 

8.49.6.8.  Separate  all  BLACK  power  lines  from  RED  wire  lines,  RED  power  lines,  and  RED  sig¬ 
nal  ground  wire  by  the  distance  specified  in  the  applicable  countermeasure  review  attachment,  or, 

8.49.6.9.  Shield  all  BLACK  power  lines,  or, 

8.49.6.10.  Eilter  all  BLACK  power  lines,  and, 

8.49.6. 1 1 .  Separate  all  BLACK  signal  ground  wires  from  RED  wire  lines,  RED  power  lines,  RED 
signal  ground  wires,  BLACK  wire  lines,  and  BLACK  power  lines  by  the  distance  specified  in  the 
applicable  countermeasure  review  attachment,  or, 

8.49.6. 12.  Insulate  and  run  all  BLACK  signal  ground  wires  in  emt  grounded  at  the  earth  electrode 
subsystem. 
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8.50.  Countermeasure  --  TEMPEST-Certified  Equipment. 

8.50.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  in  RED  equipment  as  a  result 
of  state  changes  in  electronic  circuits  and  current  flow  in  traces  and  wires.  The  wires,  traces,  frame, 
and  cover  of  BLACK  equipment,  BLACK  wire  lines,  BLACK  power  lines,  BLACK  signal  ground 
wires,  and  fortuitous  conductors  can  act  as  receiving  antennas  and  pick  up  compromising  emanations 
from  nearby  RED  equipment.  The  problem  is  compromising  emanations  can  escape  the  inspectable 
space  if  BLACK  wire  lines,  BLACK  power  lines,  and  fortuitous  conductors  exit  the  inspectable 
space. 

8.50.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  use  TEMPEST-certified  equipment. 

8.50.3.  What  the  Countermeasure  Does.  TEMPEST-certified  equipment  is  equipment  designed  and 
constructed  to  reduce  compromising  emanations;  tested,  according  to  the  current  edition  of  NSTIS- 
SAM/TEMPEST  1-92;  and  meets  the  Level  I  limits.  Using  low-level  signaling,  filtering,  internal 
shielding,  and  other  design  practices,  TEMPEST-certified  equipment  is  virtually  free  of  conducted 
and  radiated  compromising  emanations. 

8.50.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  all  the 
required  countermeasures  can  be  applied  and  they  provide  the  required  protection.  Do  not  apply  this 
countermeasure  if  the  cost  of  TEMPEST-certified  equipment  exceeds  the  cost  of  applying  the  counter¬ 
measures  required  by  the  applicable  countermeasures  review  attachment.  A  hidden  cost  is  the  cost  of 
maintaining  TEMPEST-certified  equipment,  approximately  ten  times  the  cost  of  a  non-TEM- 
PEST-certified  version.  CTTA  validation  is  required  before  TEMPEST-certified  equipment  can  be 
purchased. 

8.50.5.  How  To  Apply  the  Countermeasure.  Simply  stated,  install  the  equipment  as  you  would  any 
other  RED  equipment.  Do  not  connect  to  RED  power.  Apply  RED  equipment  separation  and  RED 
line  countermeasures  according  to  the  applicable  countermeasures  review  attachment.  Any  modifica¬ 
tion  or  change  to  the  as -manufactured  condition  of  TEMPEST-certified  equipment  voids  the  TEM¬ 
PEST  certification.  If  the  TEMPEST-certified  equipment  is  modified  or  altered,  it  is  no  longer 
TEMPEST-certified.  Retesting  by  a  certified  test  agency  is  required  to  recertify  it;  a  very  costly  proce¬ 
dure. 

8.50.6.  Alternatives.  The  alternatives  to  using  TEMPEST-certified  equipment  are  to  apply  all  the 
required  countermeasures  identified  in  the  applicable  countermeasures  review  attachment. 

8.51.  Countermeasure  —  Shielding.  In  certain  instances,  systems  processing  classified  information  are 
so  large  and  complex  that  applying  all  required  EMSEC  countermeasures  is  impossible  or  exorbitantly 
expensive.  In  hostile  environments  where  it  is  known  that  compromising  emanations  are  exploited,  apply¬ 
ing  all  required  countermeasures  may  not  provide  sufficient  protection.  In  other,  less  hostile  environments 
where  United  States  control  is  extremely  limited,  applying  all  required  EMSEC  countermeasures  may  be 
too  costly  or  may  not  provide  sufficient  protection. 

8.51.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  in  RED  equipment  as  a  result 
of  state  changes  in  electronic  circuits  and  current  flow  in  traces  and  wires.  The  wires,  traces,  frame, 
and  cover  of  BLACK  equipment,  BLACK  wire  lines,  BLACK  power  lines,  BLACK  signal  ground 
wires,  and  fortuitous  conductors  can  act  as  receiving  antennas  and  pick  up  compromising  emanations 
from  nearby  RED  equipment.  The  problem  is  compromising  emanations  can  escape  the  inspectable 
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space  if  BLACK  wire  lines,  BLACK  power  lines,  and  fortuitous  conductors  exit  the  inspectable 
space. 

8.51.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  shield  the  entire  facility,  or  a  room,  or 
the  RED  equipment. 

8.51.3.  What  the  Countermeasure  Does.  Shielding  the  RED  equipment  will  contain  the  compromis¬ 
ing  emanations  within  the  shielded  enclosure  and  prevent  contaminating  BEACK  equipment, 
BEACK  wire  lines,  BEACK  power  lines,  BEACK  signal  ground  wires,  and  fortuitous  conductors. 

8.51.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  all  the 
required  countermeasures  can  be  applied  and  provide  the  required  protection.  Do  not  apply  this  coun¬ 
termeasure  if  the  cost  of  shielding  exceeds  the  cost  of  applying  the  countermeasures  required  by  the 
applicable  countermeasures  review  attachment.  A  lifetime  cost  is  the  cost  of  maintaining  a  shielded 
enclosure.  CTTA  validation  is  required  before  shielded  RED  equipment  can  be  applied. 

8.51.5.  How  To  Apply  the  Countermeasure. 

8.51.5.1.  Shielding  is  applied  directly  to  equipment  (encapsulation),  within  a  room  (shielded 
enclosure),  or  to  a  complete  or  large  portion  of  a  facility  (global).  There  are  two  standards  for 
shielding  effectiveness. 

8.51.5.1.1.  Eor  equipment  encapsulation,  the  standard  is  NSTISS AM/TEMPEST  1-92,  Eevel 
I.  Encapsulating  equipment  to  meet  this  standard  in  effect  makes  it  TEMPEST-certified. 

8.51.5.1.2.  The  Air  Eorce  standard  for  shielding  effectiveness  (attenuation)  for  both  shielded 
enclosures  and  global  shielding  is  50  dB  (plus  a  10-dB  allowance  for  life-time  degradation). 
Justify  a  decision  to  provide  more  attenuation  on  equipment  with  compromising  emanations 
levels  so  strong  that  50  dB  of  attenuation  will  not  reduce  compromising  emanations  to  a  level 
where  the  inspectable  space  can  contain  them. 

8.51.5.2.  A  shielded  enclosure  (room  or  facility)  is  a  six-sided  metallic  box.  Isolate  it  both  physi¬ 
cally  and  electrically  within  the  area  under  positive  United  States  control.  Within  the  United 
States,  its  trust  territories,  and  possessions  and  in  low  and  medium  threat  areas,  provide  a  mini¬ 
mum  of  1  meter  of  CAA  around  a  shielded  enclosure.  In  high  threat  areas,  the  CAA  must  be  a 
minimum  of  3  meters. 

8.51.5.3.  Construct  the  shielded  enclosure  (room  or  facility)  meeting  the  requirements  of  NSTIS- 
SAM/TEMPEST  1-95,  (EOUO)  Shielded  Enclosures  (U). 

8.51.5.4.  Test  the  shielding  effectiveness  of  the  shielded  enclosure  (room  or  facility)  according  to 
NSTISSAM/TEMPEST  1-95. 

8.51.5.5.  Have  a  CTTA  review  and  accept  the  shielding  effectiveness  test  results  of  a  shielded 
enclosure  (room  or  facility). 

8.51.5.6.  Reverify  the  shielding  effectiveness  of  a  shielded  enclosure  (room  or  facility)  every  3 
years  following  the  guidance  in  paragraphs  8.51.5.4.  and  8.51.5.5.  Equipment  encapsulation  does 
not  require  reverification. 

8.5 1 .5.7.  Inspect  global  shields  and  shielded  enclosures  annually  for  rust,  cracks,  holes,  screw  and 
bolt  tightness,  integrity  of  welds,  door  operation,  tarnish  on  door  flanges,  etc.  Report  deficiencies 
to  maintenance  personnel.  Serious  deficiencies  may  require  recertification. 
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8.51.5.8.  Perform  maintenance  as  required.  In  some  circumstances,  using  routines  for  periodic 
maintenance  to  ensure  the  shielded  enclosure  does  not  degrade  to  unacceptable  levels  is  required. 

See  Attachment  20. 

8.5 1.5.9.  Treat  power,  signal,  and  utility  penetrations  through  the  shield  to  block  and  remove  con¬ 
ducted  compromising  emanations. 

8.51.5.10.  Within  the  shielded  enclosure,  run  all  RED  wire  lines  and  power  lines  in  emt. 

8.5 1 .5. 1 1 .  Do  not  install  cryptographic  equipment  in  the  shielded  enclosure. 

8.51.5.12.  Do  not  install  radio  equipment  in  the  shielded  enclosure. 

8.51.6.  Alternatives.  The  alternatives  to  shielding  RED  equipment  are  to  apply  all  the  required  coun¬ 
termeasures  identified  in  the  applicable  countermeasures  review  attachment. 

8.52.  Countermeasure  —  BLACK  Telephone  Systems.  Telephones  are  an  acoustic  threat  and  are 
under  the  purview  of  the  Air  Eorce  Office  of  Special  Investigations  (AEOSI)  and  the  Air  Eorce  security 
forces.  Some  telephone  security  requirements  are  addressed  in  AEI  33-220,  On-Hook  Telephone  Security, 
and  AEMAN  33-274,  On-Hook  Telephone  Security  Guidelines. 

8.52.1.  What  the  Problem  Is.  Compromising  emanations  are  produced  in  RED  equipment  as  a  result 
of  state  changes  in  electronic  circuits  and  current  flow  in  traces  and  wires.  A  metal  desktop,  metal 
bench  surface,  metal  shelf,  or  metal  cabinet  top  can  become  a  fortuitous  conductor  when  RED  equip¬ 
ment  is  placed  on  them.  The  metal  desk,  bench,  shelf,  or  cabinet  can  conduct  compromising  emana¬ 
tions  to  a  telephone  instrument  sitting  on  the  same  metal  desk,  bench,  shelf,  or  cabinet.  The  telephone 
instrument  can  couple  the  compromising  emanations  to  the  telephone  line.  The  problem  is  compro¬ 
mising  emanations  can  escape  control  if  the  telephone  lines  exit  the  inspectable  space. 

8.52.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  not  place  the  telephone  instrument  on 
the  same  metal  desktop,  metal  bench  surface,  metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment. 

8.52.3.  What  the  Countermeasure  Does.  The  countermeasure  prevents  coupling  compromising  ema¬ 
nations  from  RED  equipment  to  a  BEACK  wire  line  via  a  telephone  instrument  and  a  fortuitous  con¬ 
ductor. 

8.52.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BEACK  wire  lines,  are  controlled.  Normally,  this  countermeasure  is  not  needed  if  the 
line  distance  of  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary 
of  the  inspectable  space  is  greater  than  2,000  meters  or  if  the  BEACK  lines  are  fiber  optic. 

8.52.5.  How  To  Apply  the  Countermeasure.  Do  not  place  the  telephone  instrument  on  the  same  metal 
desktop,  metal  bench  surface,  metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment. 

8.52.6.  Alternative.  The  alternative  to  not  placing  the  telephone  instrument  on  the  same  metal  desk, 
bench,  shelf,  or  cabinet  as  the  RED  equipment  is  to  use  a  BEACK  wire  line  isolation  countermeasure. 

8.53.  Countermeasure -- BLACK  Intercom  and  Public  Address  Systems.  These  systems  are  an 
acoustic  threat  as  well  as  an  electronic  threat.  The  acoustic  portion  is  under  the  purview  of  the  AEOSI  and 
the  Air  Eorce  security  forces. 

8.53.1.  What  the  Problem  Is.  There  are  several  sources  of  compromising  emanations.  Compromising 
emanations  are  produced  in  RED  equipment  as  a  result  of  state  changes  in  electronic  circuits  and  cur- 
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rent  flow  in  traces  and  wires.  Compromising  emanations  are  produced  around  RED  wire  lines  as  a 
result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromagnetic  wave; 
in  other  words,  the  RED  wire  line  acts  as  a  transmitting  antenna.  When  equipment  processes  informa¬ 
tion,  it  can  create  noise  that  may  appear  on  the  equipment’s  power  cord;  in  the  case  of  RED  equip¬ 
ment,  these  may  be  compromising  emanations.  The  speakers  and  the  wire  lines  of  intercom  and  public 
address  systems  can  act  as  receiving  antennas  and  pick  up  compromising  emanations  from  nearby 
RED  equipment,  RED  lines,  and  RED  power  lines,  and  feed  them  back  into  the  amplifier  rebroadcast¬ 
ing  them  through  the  system  and  conducting  them  on  the  BEACK  power  cord.  The  problem  is  com¬ 
promising  emanations  can  escape  control  if  the  speaker  lines  or  the  power  lines  leave  the  inspectable 
space. 

8.53.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  contain  the  intercom  or  public  address 
system  within  the  inspectable  space  or,  when  not  completely  contained  within  the  inspectable  space, 
apply  additional  countermeasures. 

8.53.3.  What  the  Countermeasure  Does.  Containing  the  intercom  or  public  address  system  within  the 
inspectable  space  prevents  the  escape  of  compromising  emanations. 

8.53.4.  When  the  Countermeasure  Is  Not  Needed.  This  countermeasure  is  not  needed  if  the  means  of 
escape,  that  is,  BEACK  wire  lines,  are  controlled.  Normally,  this  countermeasure  is  not  needed  if  the 
line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  bound¬ 
ary  of  the  inspectable  space  is  greater  than  2,000  meters  or  if  the  BEACK  lines  are  fiber  optic. 

8.53.5.  How  To  Apply  the  Countermeasure. 

8.53.5.1.  Most  wireless  systems  use  simple  antennas  and  low  power  transmitters;  therefore,  their 
operating  range  is  limited.  However,  an  adversary  can  use  a  high-gain  antenna  and  pick  up  the  sig¬ 
nals  at  a  much  greater  distance,  on  the  order  of  one  thousand  times  greater.  Therefore,  because  the 
signal  goes  beyond  the  inspectable  space,  a  wireless  intercom  or  public  address  system  is  prohib¬ 
ited. 

8.53.5.2.  When  it  is  necessary  to  extend  the  intercom  or  public  address  system  beyond  the 
inspectable  space,  use  BEACK  wire  line  isolation  countermeasures  on  the  lines  leaving  the 
inspectable  space. 

8.53.5.3.  The  amplifiers  of  an  intercom  or  public  address  system  can  pick  up  compromising  ema¬ 
nations.  To  preclude  this,  separate  the  amplifiers  from  RED  equipment  or  enclose  the  amplifiers  in 
metal  containers. 

8.53.5.4.  The  necessary  countermeasures  are  identified  in  Attachment  6  through  Attachment  14 
with  common  criteria  in  Attachment  21. 

8.53.6.  Alternatives.  There  are  no  alternatives. 

8.54.  Countermeasure  --  BLACK  Local  Area  Networks. 

8.54.1.  What  the  Problem  Is.  There  are  several  sources  of  compromising  emanations.  Compromising 
emanations  are  produced  in  RED  equipment  as  a  result  of  state  changes  in  electronic  circuits  and  cur¬ 
rent  flow  in  traces  and  wires.  Compromising  emanations  are  produced  around  RED  wire  lines  as  a 
result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromagnetic  wave; 
in  other  words,  the  RED  wire  line  acts  as  a  transmitting  antenna.  When  equipment  processes  informa- 
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tion,  it  can  create  noise  that  may  appear  on  the  equipment’s  power  cord;  in  the  case  of  RED  equip¬ 
ment,  these  may  be  compromising  emanations. 

8.54.1.1.  The  BLACK  equipment  and  BLACK  wire  lines  of  unclassified  LANs  can  act  as  receiv¬ 
ing  antennas  and  pick  up  compromising  emanations  from  nearby  RED  equipment,  RED  lines,  and 
RED  power  lines.  The  problem  is  compromising  emanations  may  be  conducted  on  the  BLACK 
wire  lines  of  the  unclassified  LAN  and  escape  the  inspectable  space. 

8.54.1.2.  The  RED  equipment  and  RED  wire  lines  of  classified  LANs  can  radiate  compromising 
emanations  that  can  be  picked  up  by  nearby  BLACK  equipment,  BLACK  wire  lines,  BLACK 
power  lines,  BLACK  signal  ground  wires,  and  fortuitous  conductors.  The  problem  is  compromis¬ 
ing  emanations  may  be  conducted  on  the  BLACK  wire  lines  and  BLACK  power  lines  and  escape 
the  inspectable  space. 

8.54.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  use  selected  RED  and  BLACK 
(equipment,  wire  lines,  power  lines,  signal  ground  wires,  and  fortuitous  conductors)  separation  coun¬ 
termeasures  or  their  alternatives  that  are  identified  in  the  appropriate  countermeasures  review  attach¬ 
ment. 

8.54.3.  What  the  Countermeasure  Does.  Applying  selected  RED  and  BLACK  separation  counter¬ 
measures,  or  their  alternatives,  prevents  the  escape  of  compromising  emanations. 

8.54.4.  When  the  Countermeasure  Is  Not  Needed.  These  countermeasures  are  not  needed  if  the 
means  of  escape,  that  is,  BLACK  wire  lines  and  BLACK  power  lines,  are  controlled.  Normally,  these 
countermeasures  are  not  needed  if: 

8.54.4. 1 .  The  line  distance  of  BLACK  wire  lines  connected  to  BLACK  equipment  from  the  build¬ 
ing  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  2,000 
meters  or  the  BLACK  lines  are  fiber  optic,  and, 

8.54.4.2.  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 

8.54.5.  How  To  Apply  the  Countermeasure. 

8.54.5.1.  Unclassified  LANs.  These  networks  are  used  to  transfer  unclassified  information.  Treat 
these  networks  as  BLACK  equipment  and  BLACK  wire  lines.  Lollow  the  requirements  in  the 
appropriate  attachment  for  the  countermeasures  review. 

8.54.5.2.  Classified  LANs.  These  networks  are  used  to  transfer  classified  information.  Treat  these 
networks  as  RED  equipment  and  RED  wire  lines. 

8.54.5.2.1.  If  the  classified  LAN  is  wholly  contained  within  a  CAA,  treat  the  equipment  and 
signal  lines  as  RED  equipment  and  RED  wire  lines.  Lollow  the  guidance  in  the  appropriate 
attachment  for  the  countermeasures  review. 

8.54.5.2.2.  If  the  classified  LAN  is  not  wholly  contained  within  a  CAA,  the  cabling  between 
CAAs  must  be  secured.  Secure  the  cabling  by:  (1)  encryption  devices;  (2)  an  approved  intru¬ 
sion  detection  optical  carrier  system;  (3)  using  a  courier;  or,  (4)  a  protected  distribution  system 
(PDS).  ALMAN  33-221,  Communications  Security:  Protected  Distribution  Systems  (PDS), 
contains  guidance  for  constructing  PDSs. 

8.54.6.  Alternatives.  The  alternatives  are  those  listed  for  the  countermeasures  used. 
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8.55.  Countermeasure  --  Comfort  Music  Systems. 

8.55.1.  What  the  Problem  Is.  There  are  several  sources  of  compromising  emanations.  Compromising 
emanations  are  produced  in  RED  equipment  as  a  result  of  state  changes  in  electronic  circuits  and  cur¬ 
rent  flow  in  traces  and  wires.  Compromising  emanations  are  produced  around  RED  wire  lines  as  a 
result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromagnetic  wave; 
in  other  words,  the  RED  wire  line  acts  as  a  transmitting  antenna.  When  equipment  processes  informa¬ 
tion,  it  can  create  noise  that  may  appear  on  the  equipment’s  power  cord;  in  the  case  of  RED  equip¬ 
ment,  these  may  be  compromising  emanations.  The  speakers  and  wire  lines  of  comfort  music  systems 
can  act  as  receiving  antennas  and  pick  up  compromising  emanations  from  nearby  RED  equipment, 
RED  lines,  and  RED  power  lines.  One  of  the  problems  is  compromising  emanations  can  escape  con¬ 
trol  if  the  wire  lines  exit  the  inspectable  space.  Another  problem  is  the  compromising  emanations  can 
be  fed  back  to  the  amplifier  and  conducted  beyond  the  inspectable  space  on  the  amplifier’s  power 
cord. 

8.55.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  use  selected  RED  and  BEACK 
(equipment,  signal  wire  lines,  power  lines,  signal  ground  wires,  and  fortuitous  conductors)  separation 
countermeasures  or  their  alternatives  that  are  identified  in  the  appropriate  countermeasures  review 
attachment. 

8.55.3.  What  the  Countermeasure  Does.  Applying  selected  RED  and  BEACK  separation  counter¬ 
measures,  or  their  alternatives,  prevents  the  escape  of  compromising  emanations. 

8.55.4.  When  the  Countermeasure  Is  Not  Needed.  These  countermeasures  are  not  needed  if  the 
means  of  escape,  that  is,  speaker  wire  lines  and  BEACK  power  lines,  are  controlled.  Normally,  these 
countermeasures  are  not  needed  if: 

8.55.4.1.  The  music  system  is  contained  within  the  inspectable  space,  and, 

8.55.4.2.  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 

8.55.5.  How  To  Apply  the  Countermeasure.  There  are  two  types  of  comfort  music  systems,  those  that 
use  a  radio  receiver  and  those  that  do  not.  Eollow  the  requirements  in  the  appropriate  attachment  for 
the  countermeasures  review  (Attachment  6  through  Attachment  14)  with  common  criteria  in 

Attachment  21. 

8.55.6.  Alternatives.  The  alternatives  are  those  listed  for  the  countermeasures  used. 

8.56.  Countermeasure  --  BLACK  Cable  Television  Systems. 

8.56.1.  What  the  Problem  Is.  There  are  several  sources  of  compromising  emanations.  Compromising 
emanations  are  produced  in  RED  equipment  as  a  result  of  state  changes  in  electronic  circuits  and  cur¬ 
rent  flow  in  traces  and  wires.  Compromising  emanations  are  produced  around  RED  wire  lines  as  a 
result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromagnetic  wave; 
in  other  words,  the  RED  wire  line  acts  as  a  transmitting  antenna.  When  equipment  processes  informa¬ 
tion,  it  can  create  noise  that  may  appear  on  the  equipment’s  power  cord;  in  the  case  of  RED  equip¬ 
ment,  these  may  be  compromising  emanations.  Cable  TV  poses  two  problems:  the  cable  is  a  direct 
line  to  the  outside  world;  the  TV  receiver  itself. 

8.56.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  use  selected  RED  and  BEACK 
(equipment,  signal  wire  lines,  power  lines,  signal  ground  wires,  and  fortuitous  conductors)  separation 
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countermeasures  or  their  alternatives  that  are  identified  in  the  appropriate  countermeasures  review 
attachment  and  a  special  BLACK  wire  line  isolation  countermeasure. 

8.56.3.  What  the  Countermeasure  Does.  Applying  selected  RED  and  BLACK  separation  counter¬ 
measures,  or  their  alternatives,  and  a  special  BLACK  wire  line  isolation  countermeasure  prevents  the 
escape  of  compromising  emanations. 

8.56.4.  When  the  Countermeasure  Is  Not  Needed.  These  countermeasures  are  not  needed  if  the 
means  of  escape,  that  is,  the  TV  signal  cable,  are  controlled.  Normally,  these  countermeasures  are  not 
needed  if  the  cable  TV  system  is  contained  within  the  inspectable  space. 

8.56.5.  How  To  Apply  the  Countermeasure.  It  is  best  not  to  use  these  systems;  however,  where 
deemed  necessary,  take  precautions  to  lessen  the  risk  of  the  system  becoming  an  escape  medium  for 
compromising  emanations.  Apply  the  RED  and  BLACK  separation  countermeasures  and  apply  the 
special  signal  wire  line  isolation  countermeasure  identified  in  the  appropriate  countermeasure  review 
attachment  (Attachment  6  through  Attachment  14)  with  common  criteria  in  Attachment  21. 

8.56.6.  Alternatives.  The  alternatives  are  those  listed  for  the  countermeasures  used. 

8.57.  Countermeasure  --  BLACK  Television- Video  Cassette  Recorder  (VCR)  Systems. 

8.57.1.  What  the  Problem  Is.  There  are  several  sources  of  compromising  emanations.  Compromising 
emanations  are  produced  in  RED  equipment  as  a  result  of  state  changes  in  electronic  circuits  and  cur¬ 
rent  flow  in  traces  and  wires.  Compromising  emanations  are  produced  around  RED  wire  lines  as  a 
result  of  current  flow  in  the  wire  generating  a  magnetic  field  that  produces  an  electromagnetic  wave; 
in  other  words,  the  RED  wire  line  acts  as  a  transmitting  antenna.  When  equipment  processes  informa¬ 
tion,  it  can  create  noise  that  may  appear  on  the  equipment’s  power  cord;  in  the  case  of  RED  equip¬ 
ment,  these  may  be  compromising  emanations.  TV- VCR  systems  pose  a  unique  problem;  the  VCR 
can  record  compromising  emanations  during  playback  through  the  bias  head. 

8.57.2.  What  the  Countermeasure  Is.  The  countermeasure  is  to  separate  the  TV-VCR  system  as  iden¬ 
tified  in  the  appropriate  countermeasures  review  attachment  and  implement  security  procedures  for 
the  cassette  tapes. 

8.57.3.  What  the  Countermeasure  Does.  Separating  the  TV-VCR  system  from  RED  equipment,  sig¬ 
nal  wire  lines,  and  power  lines  prevents  compromising  emanations  from  being  recorded.  Applying 
security  procedures  for  the  cassette  tapes  prevents  the  escape  of  compromising  emanations. 

8.57.4.  When  the  Countermeasure  Is  Not  Needed.  These  countermeasures  are  not  needed  if  the 
means  of  escape,  that  is,  recording  compromising  emanations  on  the  cassette  tape,  are  controlled.  Eor- 
bidding  the  removal  of  cassette  tapes  or  degaussing  them  prevents  the  escape  of  compromising  ema¬ 
nations. 

8.57.5.  How  To  Apply  the  Countermeasure.  It  is  best  not  to  use  these  systems  near  RED  equipment, 
signal  wire  lines,  and  power  lines;  however,  where  deemed  necessary,  take  precautions  to  lessen  the 
risk  of  the  system  becoming  an  escape  medium  for  compromising  emanations.  Apply  the  countermea¬ 
sures  identified  in  the  appropriate  countermeasure  review  attachment  (Attachment  6  through  Attach¬ 
ment  14)  with  common  criteria  in  Attachment  21. 

8.57.6.  Alternatives.  Eorbid  the  removal  of  video  cassette  tapes  unless  they  are  degaussed. 
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8.58.  Secure  Telephones.  Generally,  the  STU-III  and  the  STE  are  considered  BLACK  telephones  and 
treated  as  such.  However,  when  a  FAX  machine,  PC,  or  other  device  processing  classified  information  is 
connected  to  the  secure  digital  data  port,  include  the  STU-III  or  STE  in  the  EMSEC  assessment  of  the 
whole  system.  Treat  the  STU-III  or  STE  as  cryptographic  equipment  and  make  a  cryptographic  equipment 
countermeasures  review. 

8.59.  Countermeasure  --  Timing  and  Control  Lines  Installation  Guidance.  Timing  and  control  lines 
interfacing  directly  between  BLACK  equipment  in  the  BLACK  equipment  area  and  RED  equipment  in 
the  RED  equipment  area,  without  using  a  cryptographic  equipment  as  an  interface,  require  a  filter  or  iso¬ 
lator. 

8.59.1.  Fiber  Optic  Lines.  Fiber  optic  lines  are  the  preferred  method  to  provide  timing  and  control 
signals  directly  between  BLACK  equipment  and  RED  equipment. 

8.59.1.1.  Fiber  optic  lines  provide  all  the  required  isolation  and  filtering. 

8.59.1.2.  If  the  same  source  is  used  to  provide  timing  or  control  signals  directly  to  both  RED  and 
BLACK  equipment,  no  further  isolation  or  filtering  is  necessary. 

8.59.2.  Wire  Lines.  Wire  lines  used  to  provide  timing  and  control  signals  directly  between  BLACK 
equipment  and  RED  equipment  without  using  cryptographic  equipment  as  an  interface,  require  a  filter 
or  isolator. 

8.59.2.1.  Install  the  filter  or  isolation  device  close  to  the  RED  equipment  in  the  RED  equipment 
area. 

8.59.2.2.  Use  separate  line  driver  circuits  to  connect  the  outputs  from  a  common  isolator  for  tim¬ 
ing  and  control  signals  to  the  RED  side  of  cryptographic  equipment  and  RED  equipment  to  reduce 
the  chances  of  compromising  emanations  appearing  on  these  lines. 

8.59.2.3.  Ground  filters  and  isolators  to  the  nearest  appropriate  RED  or  BLACK  signal  grounds. 

8.60.  Countermeasure  —  Utility  Control  Cables.  Install  utility  control  cables  associated  with  fire 
detection,  fire  alarm,  air  conditioning,  and  similar  control  and  warning  systems  within  the  inspectable 
space  in  separate  distribution  facilities.  The  cables  must  have  one  overall  shield  if  they  are  located  within 
approximately  1  meter  of  the  RED  processor.  Ground  the  shield  to  BLACK  signal  ground  wire.  Filtering 
utility  control  cables  is  not  required  if  the  entire  run  of  lines  is  within  the  inspectable  space,  they  are 
enclosed  in  metallic  distribution  facilities,  and  the  control  and  detection  equipment  cannot  serve  as  trans¬ 
ducers.  Isolate  these  lines  if  EMSEC  tests  show  that  compromising  emanations  are  recoverable  beyond 
the  inspectable  space. 

8.61.  Operating  and  Maintenance  Practices. 

8.61.1.  Operating  Procedures.  Although  conscientious  application  of  certain  operating  procedures 
can  help  to  reduce  the  compromising  emanations  hazard,  it  does  not  provide  a  safe  substitute  for  good 
physical  security  and  the  appropriate  countermeasures  identified  for  the  facility,  system,  or  equip¬ 
ment. 

8.61.1.1.  Operate  equipment  with  doors  closed  and  covers  in  place  to  reduce  the  distance  compro¬ 
mising  emanations  may  travel. 
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8.61.1.2.  Operate  multiple  processors  simultaneously  whenever  possible  to  increase  the  ambient 
noise  level  and  mask  some  of  the  emanations  possibly  carrying  classified  information.  This  is  an 
aid  but  not  a  solution. 

8.61.1.3.  Process  infrequently  processed  classified  information  when  activity  and  the  ambient 
noise  level  are  highest.  This  is  normally  during  daytime  working  hours. 

8.61.2.  Maintenance  Practices.  Proper  and  timely  maintenance  practices  are  essential  to  an  emanation 
control  program.  Voids  in  this  area  may  negate  other  countermeasures  due  to  the  degeneration  of 
equipment  components  or  actual  malfunctions.  See  Chapter  6  for  maintenance  guidance. 

8.62.  Control  of  RED  Equipment.  In  the  best  of  all  worlds,  RED  equipment  is  kept  under  continuous 
control  during  shipping,  storage,  installation,  operation,  and  maintenance;  in  other  words,  cradle-to-grave. 
Such  control  would  make  it  very  difficult  for  hostile  intelligence  agents  to  make  unauthorized  modifica¬ 
tions  (e.g.,  transmitting  devices)  which  may  go  undetected.  This  is  especially  true  for  TEMPEST-certified 
equipment  that  are  intended  to  process  classified  information.  National,  DoD,  and  Air  Eorce  managers 
understand  that  this  control  is  highly  desirable  but  acknowledge  that  it  is  too  costly  and  not  currently  fea¬ 
sible.  However,  apply  some  controls,  where  feasible  and  cost  effective.  At  this  time,  the  decision  is  left  to 
the  user  and  lA  office  to  find  a  workable  method  to  provide  a  degree  of  control  that  is  felt  adequate  and 
affordable  for  the  situation.  In  fact,  there  are  some  situations,  particularly  in  locations  outside  the  United 
States  where  control  of  the  equipment  during  maintenance  is  an  operational  security  requirement.  Chap¬ 
ter  6  contains  transportation  and  handling  controls  for  equipment  that  process  classified  information. 

8.63.  Information  Collections,  Records,  and  Forms. 

8.63.1.  Information  Collections.  No  information  collections  are  created  by  this  publication. 

8.63.2.  Records.  No  records  are  created  by  this  publication. 

8.63.3.  Forms  Adopted  and  Prescribed. 

8.63.3.1.  Adopted  Forms.  AF  Form  4170,  Emission  Security  Assessments/Emission  Security 
Countermeasures  Reviews,  and  AF  Form  847,  Recommendation  for  Change  of  Publication, 

are  adopted  by  this  publication. 

8.63.3.2.  Prescribed  Forms.  No  forms  are  prescribed  by  this  publication. 


JOHN  F.  WOODWARD,  JR.,  Ft  Gen,  USAF 
DCS/Communications  and  Information 
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Attachment  1 

GLOSSARY  OF  TERMS  AND  SUPPORTING  INFORMATION 


References 

Occupational  Safety  and  Health  Act  of  1970  (P.L.  91-596) 

Paperwork  Reduction  Act  of  1980  (P.L.  96-511) 

Federal  Communications  Commission  Regulation,  Part  15,  Subpart  J 
National  Electric  Code,  Article  250-5(d) 

DoD  5200. 1-R,  Information  Security  Program,  January  1977 
NSTISSI  7000,  (C)  TEMPEST  Countermeasures  for  Eacilities  (U) 

NSTISSAM/TEMPEST  1-92,  (C)  Compromising  Emanations  Laboratory  Test  Requirements,  Electro¬ 
magnetics  (U) 

NSTISSAM/TEMPEST  1-95,  (EOUO)  Shielded  Enclosures  (U) 

NSTISSAM/TEMPEST  2-95,  (EOUO)  RED/BLACK  Installation  Guidance  (U) 

AEPD  33-2,  Information  Protection  (will  become  “Information  Assurance  [lA]”) 

AEDIR  33-303,  Compendium  of  Communications  and  Information  Terminology 

AEI  31-501,  Personnel  Security  Program  Management 

AEI  32-1065,  Grounding  Systems 

AEI  33-203,  Emission  Security 

AEI  33-220,  On-Hook  Telephone  Security 

AEI  33-360,  Volume  2,  Eorms  Management  Program 

AEMAN  33-221,  Communications  Security:  Protected  Distribution  Systems  (PDS) 

AEMAN  33-272,  (S)  Classifying  Communications  Security,  TEMPEST,  and  C4  Systems  Security 
Research  and  Development  Information  (U) 

AEMAN  33-274,  On-Hook  Telephone  Security  Guidelines 

AEMAN  37-139,  Records  Disposition  Schedule  (will  become  AEMAN  33-322,  Volume  4) 

AESSI  5020,  Remanence  Security  (will  become  AEMAN  33-224) 

AESSI  7010,  (S)  Emission  Security  Assessments  (U)  (will  become  AEMAN  33-214,  Volume  1) 

Abbreviations  and  Acronyms 
AC — Alternating  Current 
AFDIR — Air  Eorce  Directory 
AFI — Air  Eorce  Instruction 
AFMAN — Air  Eorce  Manual 
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AFOSI — Air  Force  Office  of  Special  Investigations 

AFPD — Air  Force  Policy  Directive 

AFSSI — Air  Force  Systems  Security  Instruction 

AFSSM — Air  Force  Systems  Security  Memorandum 

AW G — American  Wire  Gauge 

bps — Bits  Per  Second 

C&A — Certification  and  Accreditation 

CAA — Controlled  Access  Area 

CD — Compact  Disk 

COMSEC — Communications  Security 

CSO — Communications  and  Information  Systems  Officer 

CTTA — Certified  TEMPEST  Technical  Authority 

dB — decibel 

DC — Direct  Current 

DIA — Defense  Intelligence  Agency 

DoD — Department  of  Defense 

DTD — Data  Transfer  Device 

EKMS — Electronic  Key  Management  System 

E-mail — Electronic  Mail 

EMSEC — Emission  Security 

emt — Electrical  Metallic  Tubing 

ERTZ — Equipment  Radiation  TEMPEST  Zone 

ETPL — Endorsed  TEMPEST  Products  Eist 

FAX — Facsimile 

FFC— FORTEZZA  For  Classified 
GHz — Gigahertz 

GZA — Generic  Zone  Assignments 

HQ  AFC  A — Headquarters  Air  Force  Communications  Agency 

HQ  USAF — Headquarters  United  States  Air  Force 

lA — Information  Assurance 

kbps — Kilobit  or  Kilobyte  per  second 

LAN — Focal  Area  Network 
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MAJCOM — Major  Command 
MHz — Megahertz 

NSTISSAM — National  Security  Telecommunications  and  Information  Systems  Security  Advisory 
Memorandum 

NSTISSI — National  Security  Telecommunications  and  Information  Systems  Security  Instruction 
NSTISSM — National  Security  Telecommunications  and  Information  Systems  Security  Memorandum 
P.  L. — Public  Law 

SCI — Sensitive  Compartmented  Information 

SDD — Secure  Data  Device 

SPECAT — Special  Category 

STE — Secure  Terminal  Equipment 

STU-III — Secure  Telephone  Unit  III 

TV — Television 

U.S. — United  States 

VCR — Video  Cassette  Recorder 

Terms 

BLACK — Designation  applied  to  telecommunications  and  information  systems,  and  to  associated  areas, 
circuits,  components,  equipment,  and  wire  lines  in  which  only  unclassified  signals  are  processed. 

BLACK  Line — Any  transmission  line  in  which  only  unclassified  or  enciphered  signals  are  carried. 

BLACK  Signal — Any  signal  (e.g.,  enciphered  or  control  signal)  that  would  not  divulge  classified 
information  if  recovered  and  analyzed. 

Certified  TEMPEST  Technical  Authority  (CTTA)  — An  experienced,  technically  qualified 
government  employee  who  has  met  established  certification  requirements  according  to  National  Security 
Telecommunications  and  Information  Systems  Security  Committee-approved  criteria  and  is  appointed  by 
a  United  States  Government  department  or  agency  to  fulfill  CTTA  responsibilities. 

Compromising  Emanation — Unintentional  signal  that,  if  intercepted  and  analyzed,  would  disclose  the 
information  transferred,  received,  handled,  or  otherwise  processed  by  any  information-processing 
equipment. 

Controlled  Access  Area  (CAA) — The  complete  building  or  facility  area  under  direct  physical  control 
within  which  unauthorized  persons  are  denied  unrestricted  access  and  are  either  escorted  by  authorized 
persons  or  are  under  continuous  physical  or  electronic  surveillance. 

Countermeasure  (CM) — 1.  Any  action,  device,  procedure,  technique,  or  other  measure  that  reduces  the 
vulnerability  of  an  information  system;  also  called  a  “safeguard”.  A  countermeasure  protects  against  a 
specific  threat  type  or  mechanism.  2.  The  sum  of  a  safeguard  and  its  associated  controls. 

Countermeasures  Review — A  technical  evaluation  of  a  facility  to  identify  the  inspectable  space,  the 
required  countermeasures,  and  the  most  cost-effective  way  to  apply  required  countermeasures. 
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Emanation — Unintended  signals  or  noise  appearing  external  to  an  equipment. 

Emission  Security  (EMSEC)  — The  protection  resulting  from  all  measures  taken  to  deny  unauthorized 
persons  information  of  value  that  is  derived  from  intercept  and  analysis  of  compromising  emanations 
from  cryptographic  equipment,  information  systems,  and  telecommunications  systems. 

EMSEC  Assessment — A  desktop  analysis  to  determine  whether  or  not  an  EMSEC  countermeasures 
review  is  required.  There  are  separate  EMSEC  assessments  for  the  information  systems  (control  of 
compromising  emanations),  communications  systems,  and  cryptographic  equipment. 

EMSEC  Countermeasures  Review — The  evaluation  of  a  facility  where  classified  information  will  be 
processed  that  identifies  the  EMSEC  vulnerabilities  and  threats,  and  determines  the  required  EMSEC 
countermeasures . 

Equipment  Radiation  TEMPEST  Zone  (ERTZ)  — A  zone  established  as  a  result  of  determined  or 
known  equipment  radiation  TEMPEST  characteristics.  The  zone  includes  all  space  within  which  a 
successful  hostile  intercept  of  compromising  emanations  is  considered  possible. 

Facility — 1.  A  real-property  entity  consisting  of  one  or  more  of  the  following:  a  building,  a  structure,  a 
utility  system,  pavement,  and  underlying  land.  2.  A  physically  definable  area  that  contains  classified 
information-processing  equipment. 

Fortuitous  Conductor — Any  conductor  that  may  provide  an  unintended  path  for  compromising 
emanations.  Fortuitous  conductors  include  cables,  wires,  pipes,  conduits,  ducts,  and  structural  metal  work 
in  the  vicinity  of  RED  equipment. 

Hazard — A  measure  of  both  the  existence  and  the  compromising  nature  of  an  emanation.  Hazards  exist 
if  and  only  if  compromising  emanations  are  detectable  beyond  the  inspectable  space. 

Inspectable  Space — The  three-dimensional  space  surrounding  equipment  that  processes  classified  or 
sensitive  information  within  which  TEMPEST  exploitation  is  not  considered  practical,  or  where  legal 
authority  to  identify  or  remove  a  potential  TEMPEST  exploitation  exists. 

Line  Conduction — Unintentional  signals  or  noise  induced  or  conducted  on  a  telecommunications  or 
information  system  signal,  power,  control,  indicator,  or  other  external  interface  line. 

Radiated  Signal — Electromagnetic  or  acoustic  emissions  of  undesired  signal  data  that  are  propagated 
through  space. 

Radiation — Signals  emanating  from  an  equipment  that  appears  as  either  electromagnetic  fields  or  as 
spatial  longitudinal  waves.  These  include  induction  field,  magnetic  field,  electric  field,  and  acoustic 
waves. 

RED — Designation  applied  to  telecommunications  and  information  systems,  plus  associated  areas, 
circuits,  components,  equipment,  and  wire  lines  that  require  protection  during  electrical  transmission 
when  classified  plain-text  signals  are  being  processed. 

RED  and  BLACK  Concept — Separation  of  electrical  and  electronic  circuits,  components,  equipment, 
and  systems  that  handle  classified  plain-text  (RED)  information  in  electrical  signal  form  from  those 
which  handle  unclassified  (BEACK)  information  in  the  same  form. 

RED  Line — Any  line  in  which  classified  or  unenciphered  signals  are  carried. 

RED  Signal  — Telecommunication  or  information  system  signal  that  would  divulge  classified 
information  if  recovered  and  analyzed.  RED  signals  are  plain  text,  key,  subkey,  initial  fill,  control,  or 
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traffic  flow  related  information. 

TEMPEST — Short  name  referring  to  the  investigation,  study,  and  control  of  compromising  emanations 
from  telecommunications  and  information  systems  equipment. 

TEMPEST-Certified  Equipment — Systems  or  equipment  that  were  certified  within  the  requirements  of 
the  effective  edition  of  NSTISS AM/TEMPEST  1-92,  Eevel  I. 

TEMPEST  Profile — An  indication  of  the  nature  and  amplitude  of  radiated  or  conducted  signals 
containing  compromising  emanations  escaping  from  the  equipment. 
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Attachment  2 

TRANSPORTABLE  SYSTEMS  IN  A  TACTICAL  ENVIRONMENT 

A2.1.  General.  Communications  systems  are  the  primary  EMSEC  concern  for  transportable  systems 
operated  in  a  tactical  environment.  To  properly  protect  transportables,  the  following  guidance  is  recom¬ 
mended. 

A2.2.  Modes  of  Operation.  Transportable  systems  are  operated  in  any  combination  of  a  number  of 
modes  including:  (1)  fixed  or  docked  semipermanently  to  a  permanent  facility;  (2)  field  deployed  to  a  spe¬ 
cific  location  from  one  day  to  a  few  weeks;  and,  (3)  vehicular  mounted,  meaning  operating  while  on  the 
move  or  when  stopped  briefly  generally  for  less  than  a  day.  Transportable  systems  may  also  operate  singly 
or  in  groups.  Groups  are  operated  with  interconnecting  cabling. 

A2.3.  Fixed  Transportable  Systems.  Install  transportable  systems  operated  in  a  fixed  environment  for 
over  60  days  according  to  Attachment  14.  Apply  the  following  additional  countermeasures: 

A2.3.1.  Use  shielded  and  insulated  overall  RED  wire  lines. 

A2.3.2.  Separate  RED  equipment  from  BEACK  equipment  with  signal  wire  lines  that  exit  the 
inspectable  space  or  are  connected  to  a  radio  frequency  transmitter  by  1  meter. 

A2.3.3.  If  the  separation  is  not  achieved,  conduct  countermeasures  reviews  to  determine  whether  fil¬ 
ters  or  other  countermeasures  are  needed.  Eor  existing  facilities,  the  user  may  request  EMSEC  tests 
for  compromising  emanations  to  assist  in  developing  requirements.  Request  assistance  from  the 
CTTA  if  needed. 

A2.3.4.  Since  transportable  systems  are  developed  to  operate  in  a  field  environment,  additional  vul¬ 
nerabilities  are  introduced  through  operation  in  a  fixed  environment.  There  are  requirements  for 
inspectable  space  and  the  need  to  contain  compromising  emanations  within  the  inspectable  space. 
Also,  there  may  be  power  source  restrictions  (generator,  commercial,  etc.)  and  grounding  require¬ 
ments.  The  user  may  request  EMSEC  compromising  emanations  tests  to  assist  in  developing  require¬ 
ments.  Request  assistance  from  the  CTTA  if  needed. 

A2.4.  Field  Transportable  Systems.  Install  transportable  systems  according  to  Attachment  14.  Apply 
the  requirements  of  paragraphs  A2.3.I.  and  A2.3.2.  when  field  transportable  systems  are  deployed  in  tac¬ 
tical  situations. 

A2.5.  Vehicular  Mounted  Systems.  As  long  as  vehicular  mounted  systems  are  not  using  commercial 
power  and  are  not  connected  to  conductors  exiting  the  inspectable  space,  only  the  requirements  listed 
below  apply.  Otherwise,  countermeasures  reviews  are  required  to  determine  if  additional  requirements  are 
needed.  Request  assistance  from  the  CTTA  if  needed. 

A2.5. 1 .  Do  not  power  RED  equipment  from  the  same  power  circuits  as  radio  frequency  transmitters. 
One  way  to  achieve  this  is  to  filter  the  power  lines  to  either  the  RED  equipment  or  radio  equipment. 

A2.5.2.  Shield  and  insulate  overall  the  RED  wire  lines. 

A2.5.3.  Separate  RED  wire  lines  from  BEACK  wire  lines  and  BEACK  power  lines  connected  to  a 
radio  frequency  transmitter  by  5  centimeters. 
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A2.5.4.  Separate  to  the  maximum  extent  possible,  but  not  less  than  5  centimeters,  RED  equipment 
from  BLACK  equipment  and  BLACK  wire  lines. 

A2.5.5.  The  user  may  request  EMSEC  compromising  emanations  tests  to  determine  the  acceptability 
of  the  installation. 

A2.6.  Deploying  Equipment  Away  From  Transportables.  When  removing  equipment  from  a  trans¬ 
portable  and  deploying  it  to  tents  or  buildings,  realize  that  any  shielding  effectiveness  of  the  transport¬ 
able’s  shelter  is  lost  and  that  field  expedient  installation  methods  may  create  EMSEC  hazards.  Buildings 
may  have  large  numbers  of  fortuitous  conductors  that  can  conduct  signals  beyond  the  inspectable  space. 
If  such  an  installation  is  in  place  longer  than  60  days,  consider  the  installation  a  fixed  location  and  com¬ 
plete  EMSEC  assessments  and  countermeasures  reviews  to  determine  additional  countermeasures. 
Request  assistance  from  the  CTTA  if  needed. 

A2.7.  Physical  Security.  Incorporate  the  management  of  inspectable  space  and  the  control  of  conduc¬ 
tors  leaving  the  inspectable  space  into  the  tactical  physical  security  plan. 
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Attachment  3 
AIRCRAFT 

A3.1.  Introduction.  Communications  systems  are  the  primary  EMSEC  concern  for  aircraft  systems 
(fixed  wing,  rotary  wing,  remotely  piloted  vehicles  and  manned  and  unmanned  spacecraft).  Due  to  the 
nature  of  communications  systems,  request  a  test  of  aircraft  processing  classified  information  according 
to  paragraph  7.3.  To  properly  protect  aircraft  systems,  the  following  minimum  guidance  is  provided. 

A3.2.  Information  Assurance  Countermeasures.  When  processing  any  level  of  classified  information 
on  aircraft,  select  lA  countermeasures  from  this  listing: 

A3.2.1.  Expose  RED  Eines.  Wherever  possible  and  practical,  expose  RED  lines  to  viewing. 

A3. 2. 2.  Control  Classified  Information.  Make  sure  that  every  signal  line  from  a  RED  equipment  is 
routed  only  to  another  RED  equipment  or  is  encrypted  before  connection  to  a  BEACK  equipment. 

A3. 2. 3.  Secure  RED  Eines.  Make  sure  all  RED  lines  remain  within  the  aircraft  or  are  secured  before 
leaving  the  aircraft. 

A3. 2. 4.  Account  for  RED  Eines.  Account  for  and  maintain  accountability  of  all  RED  lines. 

A3. 2. 5.  Identify  RED  Eines.  Mark  all  RED  lines  with  a  1-inch  wide  strip  of  red  tape  or  red  paint  at 
each  end  and  at  intervals  of  approximately  1-1/2  meters  wherever  they  are  exposed  to  viewing.  If 
there  are  fewer  BEACK  lines  than  RED  lines,  BEACK  lines  may  be  marked  instead  of  RED  lines.  If 
this  option  is  chosen,  mark  BEACK  lines  with  a  1-inch  wide  strip  of  black  tape  or  black  paint  at  inter¬ 
vals  of  approximately  1-1/2  meters. 

A3. 2. 6.  Separate  Patch  Panels.  Separate  RED  patch  panels  from  BEACK  patch  panels  by  a  distance 
greater  than  the  longest  patch  panel  cord  or  use  dissimilar  jack  fields. 

A3. 2. 7.  Control  BEACK  Magnetic  Media.  To  preclude  accidentally  writing  compromising  emana¬ 
tions  to  unclassified  magnetic  media: 

A3.2.7.1.  Separate  RED  equipment,  RED  wire  lines,  RED  power  cords,  RED  signal  ground 
wires,  and  BEACK  signal  ground  wires  from  any  BEACK  tape  players  or  recorders,  (e.g.,  audio 
[comfort  music  system],  video  [TV-VCR  system],  unclassified  data  recorders  or  players,  etc.),  by 
2  meters,  and, 

A3. 2. 7. 2.  Magnetic  tapes  brought  aboard  and  played  may  not  leave  the  aircraft;  or 

A3. 2. 7. 3.  Magnetic  tapes  brought  aboard  and  played  must  be  stored  in  a  secure  facility  when 
removed  from  the  aircraft,  or, 

A3. 2. 7. 4.  Degauss  the  magnetic  tapes  upon  removal. 

A3. 2. 7. 5.  The  decision  to  allow  tapes  onto  the  aircraft  is  made  by  the  unit’s  security  manager. 

A3.3.  Aircraft  Installations.  There  are  two  modes  of  operation  to  consider  with  aircraft  installations: 
airborne  operations  and  ramp  operations.  Take  into  account  weight,  size,  power  consumption,  cooling 
requirements,  and  available  space  when  designing  aircraft  systems  and  applying  countermeasures. 

A3.4.  Airborne  Operations.  Use  the  following  countermeasures  to  install  aircraft  systems: 


AFMAN33-214V2  21  SEPTMEBER  2001 


97 


A3.4.1.  Separate  RED  equipment  1  meter  from  BLACK  equipment  with  signal  wire  lines  that  are 
connected  to  a  radio  frequency  transmitter. 

A3.4.2.  Separate  RED  equipment  1  meter  from  BLACK  wire  lines. 

A3.4.3.  Separate  RED  equipment  1  meter  from  BLACK  power  lines. 

A3.4.4.  Separate  RED  wire  lines  5  centimeters  from  BLACK  wire  lines. 

A3.4.5.  Shield  and  insulate  overall  RED  wire  lines. 

A3.4.6.  If  the  separation  is  not  achieved,  conduct  countermeasures  reviews  to  determine  whether  fil¬ 
ters  or  other  countermeasures  are  needed. 

A3. 4. 7.  Grounding  on  aircraft  is  very  critical.  While  it  may  appear  that  the  skin  and  structure  of  an 
aircraft  would  provide  an  equipotential  plane,  empirical  data  shows  that,  due  to  seams,  material  use, 
and  static  buildup  during  flight,  many  current  paths  exist.  Additionally,  the  structure  provides  power 
return,  protective  ground,  and  signal  grounds.  Take  this  into  account  in  designing  the  grounding 
scheme.  The  following  supersedes  the  guidance  in  Chapter  8: 

A3 .4.7 . 1 .  Install  protective  grounds . 

A3. 4. 7. 2.  Provide  separate  RED  and  BLACK  signal  ground  systems.  Separate  RED  signal 
ground  wires  0.5  meters  from  BLACK  signal  ground  wires.  Establish  a  signal  ground  at  each  com¬ 
ponent  level  requiring  a  return  path. 

A3 .4. 7. 3.  Ground  the  shields  of  cables  at  both  ends  and  at  intermediate  points  as  practical  by  the 
most  direct  route  to  the  aircraft  structure. 

A3.5.  Ramp  Operations.  Design  all  aircraft  systems  to  comply  with  the  requirements  for  paragraph 
A3.4.  Since  aircraft  systems  are  installed  for  airborne  operation,  additional  vulnerabilities  are  introduced 
through  operation  in  a  fixed  environment.  There  are  requirements  for  inspectable  space  and  the  need  to 
contain  compromising  emanations  within  the  inspectable  space.  Also,  there  may  be  power  source  restric¬ 
tions  (generator,  commercial,  etc.),  and  grounding  procedures.  It  is  permitted  to  request  EMSEC  compro¬ 
mising  emanations  tests  to  assist  in  developing  requirements.  Request  assistance  from  the  CTTA  if 
needed. 

A3.6.  Physical  Security.  Incorporate  the  management  of  inspectable  space  and  the  control  of  conduc¬ 
tors  leaving  the  inspectable  space  into  the  physical  security  plan  for  ramp  operations. 
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Attachment  4 

DOCUMENTING  THE  COUNTERMEASURES  REVIEWS 

A4.I.  Introduction.  These  instructions  provide  the  details  for  documenting  the  required  countermea¬ 
sures  identified  by  the  information  systems,  communications  systems,  and  cryptographic  equipment 
countermeasures  reviews.  Use  AF  Form  4170,  PART  II  EMISSION  SECURITY  COUNTERMEA¬ 
SURES  REVIEWS,  block  5  (REQUIREMENTS),  block  10  (CONTINUATION),  and  copies  of  block  10, 
if  needed. 

A4.1.1.  Enter  the  tracking  number  at  the  top  of  each  page  after  "10.  (U)  CONTINUATION." 

A4.I.2.  Number  all  pages  "(Page  Y  of  Z)"  at  the  top  under  "10.  (U)  CONTINUATION." 

A4.I.3.  Enter  "(Continued  on  Page  Y  of  Z)"  within  block  10  at  the  bottom  of  each  page  except  the 
last  page. 

A4.2.  Documenting  the  Information  Systems  Countermeasures  Review.  Use  AE  Eorm  4170,  Part  II, 
block  5,  block  10,  and  copies  of  block  10,  if  needed,  to  identify  the  required  information  systems  counter¬ 
measures  (see  Figure  A22.2.) 

A4.2.1.  Enter  the  heading:  “3.  (U)  INEORMATION  SYSTEMS  COUNTERMEASURES.” 

A4.2.2.  Enter  “3.1.  (U)  CRITERIONS.” 

A4.2.2.1.  Enter  "3.1.1.  (U)"  and  list  the  main  criterions  used  to  define  the  inspectable  space. 

A4.2.2.2.  Enter  "3.1.2.  (U)"  and  list  what  equipment  criterion  was  used  to  determine  the  worst 
case  equipment  profile,  the  source  of  the  profile  information,  and  the  profile. 

A4.2.2.3.  Enter  “3.1.3.  (U)  Eacility  Zone _ ,  Equipment  Zone _ countermeasures  were  used.” 

A4.2.3.  Enter  “3.2.  (C)  REQUIRED  COUNTERMEASURES  (U).” 

A4.2.3.I.  Eist  each  required  control  of  compromising  emanations  countermeasure  as  a  statement 
of  the  requirement.  Number  the  paragraphs  3.2.1,  3.2.2,  etc.  Eist  in  the  same  order  as  they  appear 
in  the  attachment  regardless  of  whether  each  is  needed.  Precede  each  listed  countermeasure  with 
“(U)”. 

A4.2.3.2.  If  you  determine  that  a  required  countermeasure  is  not  needed,  list  the  title  of  the  coun¬ 
termeasure,  followed  by  “Not  needed.”  Pollow  this  with  the  reason  why  it  is  not  needed  (e.g., 
“3.2.1.  (U)  RED  Equipment  and  BEACK  Equipment  Separation.  Not  needed.  BEACK  lines  are 
longer  than  2,000  meters  before  they  exit  the  inspectable  space.”). 

A4.2.4.  After  all  required  countermeasures  are  listed,  list  all  nonrequired  (consider)  countermeasures 
selected  as  needed.  Eist  them  in  the  same  order  as  they  appear  in  the  attachment.  Do  not  list  those  not 
selected.  Eist  the  nonrequired  countermeasure  the  same  way  as  a  required  countermeasure,  along  with 
the  reason  it  is  needed  (e.g.,  “(U)  Provide  RED  power.  The  U.S.  Government  does  not  control  the 
power  in  the  building.”).  Precede  each  listed  countermeasure  with  “(U)”. 

A4.2.5.  Complete  and  attach  the  inspectable  space  map.  Reduce  the  map  to  8-1/2  by  11  inches. 
Include  the  scale.  Indicate  the  location  of  the  building  with  the  RED  equipment  for  this  countermea¬ 
sures  review.  The  map  is  usually  unclassified  (see  Figure  A4.1.). 
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A4.2.5.1.  For  military  installations,  indicate  on  the  map  all  offices  and  areas  on  the  base  or  instal¬ 
lation  where: 

A4.2.5.1.1.  Non-U. S.  Government  persons  work  alone  (e.g.,  a  eontraetor,  unless  the  eontrac- 
tor  is  cleared  and  proeessing  elassified  information  and  doing  the  same  job  formerly  per¬ 
formed  by  cleared  U.S.  Government  personnel)  and  all  non-U. S.  Government  offices  and 
areas  on  the  base  or  installation. 

A4.2.5.1.2.  Foreign  nationals  work  alone.  Identify  the  nationality  and  purpose  of  all  foreign 
national  offices  and  areas  on  the  base  or  installation.  Identify  if  the  foreign  national  office  has 
the  right  to  refuse  U.S.  personnel  entry  for  more  than  one  hour. 

A4.2.5.2.  For  nonmilitary  installations,  indieate  on  the  map  surrounding  buildings  to  a  distanee  of 
200  meters.  Identify  significant  occupants,  organizations,  and  activities  in  the  buildings  within 
200  meters.  If  the  U.S.  Government  does  not  wholly  occupy  the  building  containing  the  RED 
equipment,  identify  and  indicate  the  location  of  non-U. S.  Government  entities. 

A4.2.6.  Make,  title,  and  attach  a  drawing  showing  the  floor  layout  of  the  RED  equipment.  The  draw¬ 
ing  may  be  free  hand.  Include  the  scale.  Reduce  the  drawing  to  8-1/2  by  11  inches.  The  drawing  is 
usually  unclassified  (see  Figure  A4.2.). 

A4.2.7.  If  information  systems  countermeasures  are  not  applicable  or  not  required,  enter  “Not  Appli¬ 
cable”  or  “Not  Required”  after  the  heading  identified  in  paragraph  A4.2.1. 
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Figure  A4.2.  Sample  Map  of  Office. 


N 


1 


Location  of  equipment  (X)  in  Building  1700,  Room  2040 

A4.3.  Documenting  the  Communications  Systems  Countermeasures  Review.  Use  AF  Form  4170, 
block  5,  block  10  (continuation),  and  copies  of  block  10,  if  needed,  to  identify  the  required  communica¬ 
tions  systems  countermeasures  (see  Figure  A22.2.). 

A4.3.1.  Enter  the  heading  “4.  (U)  COMMUNICATIONS  SYSTEMS  COUNTERMEASURES.” 

A4.3.2.  Enter  “4.1.  (U)  CRITERIONS.” 

A4.3.2.1.  Enter  “4.1.1.  (U),”  and  list  the  type  of  radios  of  concern. 

A4.3.2.2.  Enter  "4.1.2.  (U),”  and  list  what  equipment  was  used  to  determine  the  worst  case  equip¬ 
ment  profile,  the  source  of  the  profile  information,  and  the  profile. 
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A4.3.3.  Enter  “4.2.  (C)  REQUIRED  COUNTERMEASURES  (U).” 

A4.3.3.E  Eist  each  required  communications  systems  countermeasure  as  a  statement  of  the 
requirement.  Number  the  paragraphs  4.2.1,  4.2.2,  etc.  Eist  in  the  same  order  as  they  appear  in  the 
chapter.  Precede  each  listed  countermeasure  with  “(U)”. 

A4.3.3.2.  If  you  determine  a  required  countermeasure  is  not  needed,  list  the  countermeasure  fol¬ 
lowed  by  “Not  needed.”  Eollow  this  with  the  reason  why  it  is  not  needed  (e.g.,  “4.2.2.  (U)  Sepa¬ 
rate  Power  for  RED  Equipment  or  Radio  Equipment.  The  power  to  the  room  with  RED  equipment 
is  on  an  uninterrupted  power  supply,  the  radios  are  not.”). 

A4.3.4.  After  all  required  countermeasures  are  listed,  list  all  nonrequired  (consider)  countermeasures 
selected  as  needed  (usually  these  countermeasures  are  determined  by  a  CTTA).  Eist  them  in  the  same 
manner  as  a  required  countermeasure  followed  by  the  reason  it  is  needed  (e.g.,  “4.2.5.  (U)  Install  a 
RED  signal  ground  and  connect  the  signal  ground  for  all  RED  processors  to  it.  The  configuration  of 
the  RED  equipment  and  radios  makes  using  the  existing  facility  signal  ground  a  hazard.”)..  Do  not  list 
the  countermeasures  not  selected.  Precede  each  listed  countermeasure  with  “(U)”. 

A4.3.5.  Make,  title,  and  attach  a  drawing  showing  the  room  layout  of  transmitters,  receivers,  and 
RED  equipment.  The  drawing  may  be  free  hand.  Include  the  scale.  Reduce  the  drawing  to  8-1/2  by  11 
inches  (see  Figure  A4.2.).  The  drawing  is  usually  unclassified,  or, 

A4.3.6.  Make,  title,  and  attach  a  drawing  showing  the  locations  of  the  RED  equipment  and  radios 
under  consideration  in  this  communications  systems  countermeasures  review  when  all  are  not  within 
the  same  room  or  building.  The  drawing  may  be  free  hand.  Include  the  scale.  Reduce  the  drawing  to 
8-1/2  by  11  inches.  The  drawing  is  usually  unclassified. 

A4.3.7.  If  communications  systems  countermeasures  are  not  applicable  or  not  required,  enter  “Not 
Applicable”  or  “Not  Required”  after  the  heading  identified  in  paragraph  A4.3. 

A4.4.  Documenting  the  Cryptographic  Equipment  Countermeasures  Review.  Use  AE  Eorm  4170, 
block  5,  block  10  (continuation),  and  copies  of  block  10,  if  needed,  to  identify  the  required  countermea¬ 
sures  (see  Figure  A22.2.). 

A4.4.1.  Enter  the  heading  “5.  (U)  CRYPTOGRAPHIC  EQUIPMENT  COUNTERMEASURES.” 
A4.4.2.  Enter  “5.1.  (U)  CRITERIONS.” 

A4.4.2.1.  Enter  "5.1.1.  (U),"  and  list  the  cryptographic  equipment  used  to  determine  required 
countermeasures . 

A4.4.3.  Enter  “5.2.  (U)  REQUIRED  COUNTERMEASURES.” 

A4.4.3.1.  Eist  each  required  cryptographic  equipment  countermeasure  as  a  statement  of  the 
requirement.  Number  the  paragraphs  5.2.1,  5.2.2,  etc.  Eist  in  the  same  order  as  they  appear  in  the 
chapter  regardless  of  whether  each  is  needed.  Precede  each  listed  countermeasure  with  “(U)”. 

A4.4.3.2.  If  you  determine  a  required  countermeasure  is  not  needed,  list  the  countermeasure  fol¬ 
lowed  by  “Not  needed.”  Eollow  this  with  the  reason  why  it  is  not  needed  (e.g.,  “5.2.4.  (U)  Crypto¬ 
graphic  Equipment  and  RED  Equipment  Separation.  Separation  from  RED  and  BEACK 
equipment  by  1  meter  not  needed  for  KIV-7.”). 
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A4.4.4.  After  all  required  eountermeasures  are  listed,  list  all  nonrequired  (eonsider)  eountermeasures 
selected  as  needed  (usually  these  countermeasures  are  determined  by  a  CTTA).  List  these  nonrequired 
countermeasures  in  the  same  manner  as  a  required  countermeasure,  following  with  the  reason  it  is 
needed.  Do  not  list  those  countermeasures  not  selected  (e.g.,  “5.2.7.  (U)  Separate  RED  equipment  3 
meters  from  cryptographic  equipment.  The  RED  equipment  has  emanations  measured  in  watts”).  Eol- 
low  this  with  the  reason  it  is  needed.  Do  not  list  those  not  selected. 

A4.4.5.  Make,  title,  and  attach  a  drawing  showing  the  layout  of  cryptographic  equipment,  RED 
equipment  (if  any),  and  BEACK  equipment  (if  any).  The  drawing  may  be  free  hand.  Include  the  scale. 
Reduce  the  drawing  to  8-1/2  by  11  inches.  The  drawing  is  usually  unclassified. 

A4.4.6.  If  cryptographic  equipment  countermeasures  are  not  applicable  or  not  required,  enter  “Not 
Applicable”  or  “Not  Required”  after  the  heading  identified  in  paragraph  A4.4. 
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Attachment  5 

GENERIC  ZONE  ASSIGNMENTS  (GZA) 

A5.1.  This  GZA  table  (Table  A5.1.)  is  a  conversion  of  the  generic  guidance  developed  and  included  in 
the  TEMPEST  Profile  Data  Eist  (TPDE). 

Table  A5.1.  Generic  Zone  Assignments. 


EQUIPMENT 

ZONE 

EQUIPMENT 

ZONE 

EQUIPMENT 

ZONE 

Audio 

B 

Fiber  Optics 

A 

Tablet 

B 

Calculator 

B 

Keyboard 

B 

Tape  Drive 

B 

Communications 

B 

Monitor 

B 

Television 

B 

Adapter 

B 

Color 

B 

Controller 

B 

Large  Screen 

C 

Transmission 

B 

Demodulator 

B 

Monochrome 

B 

Converter 

B 

Handset 

B 

Modem 

B 

Interface 

B 

Mouse 

A 

Multiplexer 

B 

Synchronizer 

B 

Repeater 

C 

Optical  Reader 

B 

Computer 

C 

Typewriter 

B 

Laptop 

D 

Phototypesetter 

B 

Electronic 

B 

Mainframe 

B 

Magnetic 

B 

Mini 

B 

Printer 

B 

Memory 

B 

Personal 

C 

Band 

B 

Dot  Matrix 

B 

Video 

B 

COMSEC 

A 

Ink  Jet 

B 

Amplifier 

D 

Auxiliary 

B 

Laser 

B 

Camera 

B 

Mixer 

B 

Letter  Quality 

B 

Disk  Player 

B 

Secure  Device 

A 

Plotter 

B 

Player 

B 

Secure  Phone 

A 

Thermal 

C 

Processor 

C 

Projector 

C 

Copier 

B 

Slide  Maker 

D 

Recorder 

B 

Scanner 

C 

Digitizer 

B 

Switch 

B 

AB  Switch 

B 

Disk  Drive 

B 

Digital 

A 

Switchboard 

B 

FAX  Machine 

B 

Video 

B 
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Attachment  6 

FACILITY  ZONE  A,  EQUIPMENT  ZONE  A 

A6.1.  Introduction.  This  attachment  addresses  the  following  conditions: 

A6.1.1.  Facilities:  Assigned  Zone  A,  or  less  than  20  meters  of  inspectable  space. 

A6.1.2.  Equipment:  Assigned  Zone  A,  or  the  ERTZ  is  equal  to  1  meter  or  less,  or  meets  NSTISSAM/ 
TEMPEST  1-92,  Eevel  I  standards. 

A6.2.  Countermeasure  Application. 

A6.2.1.  Review  the  need  for  each  required  countermeasure.  Select  it  if  it  is  needed. 

A6.2.2.  Review  the  need  for  each  consider  countermeasure.  Do  not  select  it  unless  it  is  needed. 

A6.2.3.  Eor  existing  facilities,  when  countermeasures  involving  BEACK  equipment,  BEACK  wire 
lines,  BEACK  power  lines,  and  fortuitous  conductors  cannot  be  met,  the  user  may  request  an  EMSEC 
test  to  determine  if  the  countermeasures  are  needed. 

A6.3.  Required  Countermeasures.  Select  each  required  countermeasure  unless  the  threat  at  which  the 
countermeasure  is  aimed  does  not  exist.  Explain  why  each  required  countermeasure  not  selected  was  not 
selected.  A  waiver  is  not  needed  for  any  deselected  required  countermeasure  since  the  requirement  for 
protection  has  been  met. 

A6.3.1.  Inspectable  Space.  This  countermeasure  is  required.  Specify  the  minimum  inspectable  space 
(distance)  required  to  contain  radiated  compromising  emanations.  (See  paragraphs  8.4.  and  8.5.  for 
more  information.) 

A6.3.2.  RED  Equipment  and  BEACK  Equipment  Separation.  This  countermeasure  is  required  if 
BEACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space  unless:  (1)  the  line  distance  of 
the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines  are  fiber  optic;  and,  (2)  BEACK 
power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds 
100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See  paragraph  8.8.  for  more  information.) 

A6.3.2.1.  Separate  RED  equipment  from  BEACK  equipment  by  0.5  meters. 

A6.3.2.1.1.  The  separation  distance  is  reduced  to  15  centimeters  if  a  BEACK  wire  line  isola¬ 
tion  countermeasure  is  used. 

A6.3.2.1.2.  If  the  user  cannot  achieve  the  required  separation,  use  a  BEACK  wire  line  isola¬ 
tion  countermeasure,  filter  BEACK  power  lines,  and  isolate  fortuitous  conductors. 

A6.3.2.2.  Do  not  place  BEACK  equipment  on  the  same  metal  desktop,  metal  bench  surface, 
metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment. 

A6.3.3.  RED  Equipment  and  BEACK  Wire  Eine  Separation.  This  countermeasure  is  required  for 
BEACK  wire  lines  that  exit  the  inspectable  space  unless  the  line  distance  of  the  BEACK  wire  lines 
from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  2,000  meters  or  if  the  BEACK  lines  are  fiber  optic.  (See  paragraph  8.9.  for  more  information.) 

A6.3.3.1.  Separate  RED  equipment  from  BEACK  wire  lines  by  0.5  meters. 
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A6.3.3.1.1.  The  separation  distanee  is  redueed  to  5  eentimeters  if  the  BLACK  wire  lines  are 
shielded,  or, 

A6.3.3.1.2.  The  separation  distanee  is  redueed  to  15  eentimeters  if  a  BLACK  wire  line  isola¬ 
tion  eountermeasure  is  used. 

A6.3.3.2.  If  the  user  eannot  aehieve  this  separation,  use  a  BLACK  wire  line  isolation  eountermea- 
sure,  filter  BLACK  power  lines,  and  isolate  fortuitous  eonduetors. 

A6.3.4.  RED  Equipment  and  BEACK  Power  Line  Separation.  This  eountermeasure  is  required 
unless:  (1)  BLACK  power  lines  are  eontained  within  the  inspeetable  spaee  up  to  a  point  where  the 
average  load  exeeeds  100,000  volt- amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  dis¬ 
tanee  of  BLACK  wire  lines  eonneeted  to  BLACK  equipment  from  the  building  eontaining  the  RED 
equipment  to  the  boundary  of  the  inspeetable  spaee  is  greater  than  1,000  meters  or  the  BEACK  lines 
are  fiber  optie.  (See  paragraph  8.10.  for  more  information.) 

A6.3.4.L  Separate  RED  equipment  from  BEACK  power  lines  by  0.5  meters. 

A6.3.4.LL  The  separation  distanee  is  redueed  to  5  eentimeters  if  the  BEACK  power  lines  are 
shielded. 

A6.3.4.L2.  If  the  user  eannot  achieve  this  separation,  use  a  BEACK  wire  line  isolation  coun¬ 
termeasure,  filter  BEACK  power  lines,  and  isolate  fortuitous  conductors. 

A6.3.5.  RED  Equipment  and  Eortuitous  Conductor  Separation.  This  countermeasure  is  required  for: 
(1)  fortuitous  conductors  that  exit  the  inspeetable  space;  (2)  BEACK  wires  that  exit  the  inspeetable 
space;  and,  (3)  BEACK  power  lines  unless:  (a)  the  line  distance  of  the  BEACK  wire  lines  from  the 
building  containing  the  RED  equipment  to  the  boundary  of  the  inspeetable  space  is  greater  than  250 
meters  or  the  BEACK  lines  are  fiber  optic;  and,  (b)  BEACK  power  lines  are  contained  within  the 
inspeetable  space  up  to  a  point  where  the  average  load  exceeds  100,000  volt- amperes  and  at  least 
10,000  volts  potential.  (See  paragraph  8.12.  for  more  information.) 

A6.3.5.L  Separate  RED  equipment  from  fortuitous  conductors  by  0.5  meters. 

A6.3.5.LL  If  the  user  cannot  achieve  this  separation,  use  a  BEACK  wire  line  isolation  coun¬ 
termeasure,  filter  BEACK  power  lines,  and  isolate  fortuitous  conductors. 

A6.3.6.  RED  Wire  Eine  and  BEACK  Wire  Line  Separation.  This  countermeasure  is  required  if 
BLACK  wire  lines  exit  the  inspeetable  space  unless  the  line  distance  of  the  BLACK  wire  lines  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspeetable  space  is  greater  than 
2,000  meters  or  if  the  BEACK  lines  are  fiber  optic.  (See  paragraph  8.17.  for  more  information.) 

A6.3.6.L  Separate  RED  wire  lines  from  BEACK  wire  lines  by  5  centimeters. 

A6.3.6.LL  Do  not  place  RED  and  BEACK  wire  lines  in  a  common  distribution  facility.  It  is 
permitted  to  use  a  common  distribution  facility  for  RED  and  BEACK  fiber  optic  signal  lines 
provided: 

A6.3.6. 1 .1.1.  Either  the  BEACK  or  the  RED  fiber  optic  signal  lines  in  a  RED  distribution 
facility  must  have  an  opaque  sheath.  BEACK  fiber  optic  signal  lines  should  not  have 
metallic  stiffeners  or  sheaths.  If  they  do,  treat  the  stiffeners  or  sheaths  as  fortuitous  conduc¬ 
tors  and  ground  both  ends  of  the  stiffeners  or  sheaths  if  the  BEACK  fiber  optic  signal  lines 
leave  the  inspeetable  space. 
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A6. 3. 6. 1.1. 2.  Separate  RED  fiber  optic  signal  lines  in  BLACK  distribution  facilities  from 
the  distribution  facility  before  the  distribution  facility  exits  the  inspectable  space. 

A6.3.6. 1.1.3.  Using  multifiber  bundle  for  both  RED  and  BLACK  signals  is  not  recom¬ 
mended.  If  used,  an  opaque  partition  between  the  RED  and  BLACK  fibers  is  required. 
Maintain  total  accountability  of  all  fibers  to  preclude  compromise  through  misconnection. 

A6.3.6.2.  When  RED  and  BLACK  wire  lines  are  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters. 

A6.3.7.  RED  Wire  Line  and  BLACK  Power  Line  Separation.  This  countermeasure  is  required  unless: 
(1)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average 
load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the 
BLACK  wire  line  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable 
space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  (See  paragraph  8.18.  for  more 
information.) 

A6.3.7.1.  Separate  RED  wire  lines  from  BLACK  power  lines  by  5  centimeters. 

A6.3.7.2.  When  RED  wire  lines  and  BLACK  power  lines  are  run  parallel  for  30  meters  or  more, 
increase  the  separation  to  15  centimeters. 

A6.3.8.  Shielded  RED  Wire  Lines.  This  countermeasure  is  required.  (See  paragraph  8.23.  for  more 
information.) 

A6.3.8.1.  Lor  TEMPEST- Certified  Equipment.  RED  equipment  meeting  the  requirements  of 
NSTISS AM/TEMPEST  1-92,  Level  I  must  use  optical  or  shielded  wire  cables  if  specified  as  part 
of  the  manufacturer’s  installation  specification  or  if  specified  for  compliance  with  TEMPEST  cer¬ 
tification. 

A6.3.8.2.  Eor  Non-TEMPEST-Certified  Equipment.  Shield  and  insulate  RED  wire  lines  even 
when  all  separation  distances  for  RED  equipment,  RED  wire  lines,  RED  power  lines,  RED  signal 
ground  wires,  and  BLACK  signal  ground  wires  from  BLACK  equipment,  BLACK  wire  lines, 
BLACK  power  lines,  and  fortuitous  conductors  that  exit  the  inspectable  space  are  met.  Attach¬ 
ment  18  contains  specifications  for  shielded  cables. 

A6.3.9.  Administrative  Communications  Countermeasures.  These  countermeasures  are  required. 

A6.3.9.E  BLACK  Telephone  Systems.  Do  not  place  the  telephone  instrument  on  the  same  metal 
desktop,  metal  bench  surface,  metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment.  (See  para¬ 
graph  8.52.  for  more  information.) 

A6.3.9.2.  BLACK  LANs.  (See  paragraph  8.54.  for  more  information.) 

A6.3.9.2.1.  Separate  RED  equipment  from  LAN  equipment  and  signal  wire  lines  as  required 
for  RED  equipment  and  BLACK  equipment  separation  and  RED  equipment  and  BLACK  wire 
lines  in  this  attachment. 

A6.3.9.2.2.  Separate  RED  wire  lines  from  LAN  signal  wire  lines  as  required  for  RED  wire 
lines  in  this  attachment. 

A6.3.9.3.  Comfort  Music  Systems.  Use  paragraph  A21.3.1.  (See  paragraph  8.55.  for  more  infor¬ 
mation.) 
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A6.3.9.4.  BLACK  Cable  TV  Systems.  LFse  paragraph  A21.4.1.  Separate  aetive  splitters  or  ampli¬ 
fiers  from  RED  equipment,  RED  wire  lines,  RED  power  lines,  and  RED  signal  ground  wires  by  2 
meters.  (See  paragraph  8.56.  for  more  information.) 

A6.3.9.5.  BEACK  TV-VCR  Systems.  Use  paragraph  A21.5.1.  Separate  the  BEACK  power  eord 
from  RED  equipment,  RED  wire  lines,  RED  power  lines,  and  RED  signal  ground  wires  by  1 
meter.  (See  paragraph  8.57.  for  more  information.) 

A6.3.10.  Timing  and  Control  Eines.  This  eountermeasure  is  required.  Eollow  the  guidanee  in  para¬ 
graph  8.59. 

A6.4.  Countermeasures  to  Consider.  Do  not  select  a  consider  countermeasure  unless  the  threat  at 
which  the  countermeasure  is  aimed  does  exist.  Explain  (justify)  why  a  not-required  (consider)  counter¬ 
measure  was  selected. 

NOTE:  When  making  the  countermeasures  review,  be  more  inclined  to  select  the  “consider”  counter¬ 
measures  in  paragraphs  A6.4.1.  and  A6.4.2.  if  the  inspectable  space  is  less  than  8  meters. 

A6.4.1.  RED  Wire  Eine  and  BEACK  Equipment  Separation.  Consider  applying  this  countermeasure 
if  BEACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space.  Do  not  select  this  counter¬ 
measure  if  the  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines  are 
fiber  optic.  If  selected,  separate  RED  wire  lines  from  BEACK  equipment  by  0.5  meters.  If  a  BEACK 
wire  line  isolation  countermeasure  is  used,  the  separation  distance  is  reduced  to  15  centimeters.  (See 
paragraph  8.16.  for  more  information.) 

A6.4.2.  RED  Wire  Eine  and  Eortuitous  Conductor  Separation.  Consider  applying  this  countermea¬ 
sure  if  fortuitous  conductors  exit  the  inspectable  space.  Do  not  select  this  countermeasure  if:  (1)  the 
line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  bound¬ 
ary  of  the  inspectable  space  is  more  than  250  meters  or  the  BEACK  lines  are  fiber  optic;  or  (2) 
BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  RED  wire  lines 
from  fortuitous  conductors  by  5  centimeters.  When  RED  wire  lines  run  parallel  to  a  fortuitous  conduc¬ 
tor  for  30  meters  or  more  and  the  same  fortuitous  conductor  runs  parallel  to  BEACK  wire  lines  or 
BEACK  power  lines  for  30  meters  or  more,  increase  separation  to  15  centimeters.  (See  paragraph 
8.20.  for  more  information.) 
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Attachment  7 

FACILITY  ZONE  B,  EQUIPMENT  ZONE  A 

A7.1.  Introduction.  This  attachment  addresses  the  following  conditions: 

A7.1.1.  Facilities:  Assigned  Zone  B,  or  more  than  20  meters  but  less  than  100  meters  of  inspectable 
space. 

A7.1.2.  Equipment:  Assigned  Zone  A,  or  the  ERTZ  equal  to  1  meter  or  less,  or  meets  NSTISSAM/ 
TEMPEST  1-92,  Eevel  I  standards. 

A7.2.  Countermeasure  Application. 

A7.2.1.  Review  the  need  for  each  required  countermeasure.  Select  it  if  it  is  needed. 

A7.2.2.  Review  the  need  for  each  consider  countermeasure.  Do  not  select  it  unless  it  is  needed. 

A7.2.3.  Eor  existing  facilities,  when  countermeasures  involving  BEACK  equipment,  BEACK  wire 
lines,  BEACK  power  lines,  and  fortuitous  conductors  cannot  be  met,  the  user  may  request  an  EMSEC 
test  to  determine  if  countermeasures  are  needed. 

A7.3.  Required  Countermeasures.  Select  each  required  countermeasure  unless  the  threat  at  which  the 
countermeasure  is  aimed  does  not  exist.  Explain  why  each  required  countermeasure  not  selected  was  not 
selected.  A  waiver  is  not  needed  for  any  deselected  required  countermeasure  since  the  requirement  for 
protection  has  been  met. 

A7.3.1.  Inspectable  Space.  This  countermeasure  is  required.  Specify  the  minimum  inspectable  space 
(distance)  required  to  contain  radiated  compromising  emanations.  (See  paragraphs  8.4.  and  8.5.  for 
more  information.) 

A7.3.2.  RED  Equipment  and  BEACK  Equipment  Separation.  This  countermeasure  is  required  if 
BEACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space  unless:  (1)  the  line  distance  of 
the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines  are  fiber  optic;  and,  (2)  BEACK 
power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds 
100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See  paragraph  8.8.  for  more  information.) 

A7.3.2.1.  Do  not  place  BEACK  equipment  on  the  same  metal  desktop,  metal  bench  surface, 
metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment. 

A7.3.3.  RED  Equipment  and  BEACK  Wire  Eine  Separation.  This  countermeasure  is  required  for 
BEACK  wire  lines  that  exit  the  inspectable  space  unless  the  line  distance  of  the  BEACK  wire  lines 
from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  2,000  meters  or  if  the  BEACK  lines  are  fiber  optic.  (See  paragraph  8.9.  for  more  information.) 

A7.3.3.1.  Separate  RED  equipment  from  BEACK  wire  lines  by  0.5  meters. 

A7.3.3.1.1.  The  separation  distance  is  reduced  to  5  centimeters  if  the  BEACK  wire  lines  are 
shielded,  or, 

A7.3.3.1.2.  The  separation  distance  is  reduced  to  15  centimeters  if  a  BEACK  wire  line  isola¬ 
tion  countermeasure  is  used. 
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AT. 3.3.2.  If  the  user  cannot  achieve  this  separation,  use  a  BLACK  wire  line  isolation  countermea¬ 
sure,  filter  BLACK  power  lines,  and  isolate  fortuitous  conductors. 

A7.3.4.  RED  Equipment  and  BEACK  Power  Eine  Separation.  This  countermeasure  is  required 
unless:  (1)  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  dis¬ 
tance  of  BEACK  wire  lines  connected  to  BEACK  equipment  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BEACK  lines 
are  fiber  optic.  (See  paragraph  8.10.  for  more  information.) 

A7.3.4.L  Separate  RED  equipment  from  BEACK  power  lines  by  0.5  meters. 

A7.3.4.LL  The  separation  distance  is  reduced  to  5  centimeters  if  the  BEACK  power  lines  are 
shielded. 

A7.3.4.L2.  If  the  user  cannot  achieve  this  separation,  use  a  BEACK  wire  line  isolation  coun¬ 
termeasure,  filter  BEACK  power  lines,  and  isolate  fortuitous  conductors. 

A7.3.5.  RED  Wire  Eine  and  BEACK  Wire  Eine  Separation.  This  countermeasure  is  required  if 
BEACK  wire  lines  exit  the  inspectable  space  unless  the  line  distance  of  the  BEACK  wire  lines  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than 
2,000  meters  or  if  the  BEACK  lines  are  fiber  optic.  (See  paragraph  8.17.  for  more  information.) 

A7.3.5.L  Separate  RED  wire  lines  from  BEACK  wire  lines  by  5  centimeters. 

A7.3.5.LL  Do  not  place  RED  and  BEACK  wire  lines  in  a  common  distribution  facility.  It  is 
permitted  to  use  a  common  distribution  facility  for  RED  and  BEACK  fiber  optic  signal  lines 
provided: 

A7.3.5. 1 . 1 . 1 .  Either  the  BEACK  or  the  RED  fiber  optic  signal  lines  in  a  RED  distribution 
facility  must  have  an  opaque  sheath.  BEACK  fiber  optic  signal  lines  should  not  have 
metallic  stiffeners  or  sheaths.  If  they  do,  treat  the  stiffeners  or  sheaths  as  fortuitous  conduc¬ 
tors  and  ground  both  ends  of  the  stiffeners  or  sheaths  if  the  BEACK  fiber  optic  signal  lines 
leave  the  inspectable  space. 

A7. 3. 5. 1.1. 2.  Separate  RED  fiber  optic  signal  lines  in  BEACK  distribution  facilities  from 
the  distribution  facility  before  the  distribution  facility  exits  the  inspectable  space. 

A7.3.5. 1.1.3.  Using  multifiber  bundle  for  both  RED  and  BEACK  signals  is  not  recom¬ 
mended.  If  used,  an  opaque  partition  between  the  RED  and  BEACK  fibers  is  required. 
Maintain  total  accountability  of  all  fibers  to  preclude  compromise  through  misconnection. 

A7.3.5.2.  When  RED  and  BEACK  wire  lines  are  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters. 

A7.3.6.  RED  Wire  Eine  and  BEACK  Power  Eine  Separation.  This  countermeasure  is  required  unless: 
(1)  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average 
load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the 
BEACK  wire  line  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable 
space  is  greater  than  1,000  meters  or  the  BEACK  lines  are  fiber  optic.  (See  paragraph  8.18.  for  more 
information.) 

A7.3.6.L  Separate  RED  wire  lines  from  BEACK  power  lines  by  5  centimeters. 
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PJ 3.62.  When  RED  wire  lines  and  BLACK  power  lines  are  run  parallel  for  30  meters  or  more, 
inerease  the  separation  to  15  centimeters. 

A7.3.7.  Shielded  RED  Wire  Lines.  This  countermeasure  is  required  for  RED  equipment  meeting  the 
requirements  of  NSTISSAM/TEMPEST  1-92,  Level  I,  which  must  use  optical  or  shielded  wire  cables 
if  specified  as  part  of  the  manufacturer’s  installation  specification  or  if  specified  for  compliance  with 
TEMPEST  certification.  (See  paragraph  8.23.  for  more  information.) 

A7.3.8.  Administrative  Communications  Countermeasures.  These  countermeasures  are  required. 

A7.3.8.1.  BLACK  Telephone  Systems.  Do  not  place  the  telephone  instrument  on  the  same  metal 
desktop,  metal  bench  surface,  metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment.  (See  para¬ 
graph  8.52.  for  more  information.) 

A7.3.8.2.  BLACK  LANs.  See  paragraph  8.54.  for  more  information. 

A7.3.8.2.1.  Separate  RED  equipment  from  LAN  equipment  and  signal  wire  lines  as  required 
for  RED  equipment  and  BLACK  equipment  separation  and  RED  equipment  and  BLACK  wire 
line  separation  in  this  attachment. 

A7.3.8.2.2.  Separate  RED  wire  lines  from  LAN  signal  wire  lines  as  required  for  RED  wire 
lines  and  BLACK  wire  line  separation  in  this  attachment. 

A7.3.9.  Timing  and  Control  Lines.  This  countermeasure  is  required.  Lollow  the  guidance  in  para¬ 
graph  8.59. 

A7.4.  Countermeasures  to  Consider.  Do  not  select  a  consider  countermeasure  unless  the  threat  at 
which  the  countermeasure  is  aimed  does  exist.  Explain  (justify)  why  a  not-required  (consider)  counter¬ 
measure  was  selected. 

A7.4. 1 .  RED  Equipment  and  BLACK  Equipment  Separation.  Consider  applying  this  countermeasure 
if  BLACK  wire  lines  connected  to  the  BLACK  equipment  exit  the  inspectable  space.  Do  not  select 
this  countermeasure  if:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the 
BLACK  lines  are  fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space 
up  to  a  point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 
If  selected,  separate  RED  equipment  from  BLACK  equipment  by  0.5  meters.  If  a  BLACK  wire  line 
isolation  countermeasure  is  used,  the  separation  distance  is  reduced  to  15  centimeters.  (See  paragraph 
8.8.  for  more  information.) 

A7.4.2.  RED  Wire  Line  and  BLACK  Equipment  Separation.  Consider  applying  this  countermeasure 
if  BLACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space.  Do  not  select  this  counter¬ 
measure  if  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BLACK  lines  are 
fiber  optic.  If  selected,  separate  RED  wire  lines  from  BLACK  equipment  by  0.5  meters.  If  a  BLACK 
wire  line  isolation  countermeasure  is  used,  the  separation  distance  is  reduced  to  15  centimeters.  (See 
paragraph  8.16.  for  more  information.) 

A7.4.3.  RED  Wire  Line  and  Lortuitous  Conductor  Separation.  Consider  applying  this  countermea¬ 
sure  if  fortuitous  conductors  exit  the  inspectable  space.  Do  not  select  this  countermeasure  if:  (1)  the 
line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  bound¬ 
ary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines  are  fiber  optic;  or  (2) 
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BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  RED  wire  lines 
from  fortuitous  conductors  by  5  centimeters.  When  RED  wire  lines  run  parallel  to  a  fortuitous  conduc¬ 
tor  for  30  meters  or  more  and  the  same  fortuitous  conductor  runs  parallel  to  BEACK  wire  lines  or 
BEACK  power  lines  for  30  meters  or  more,  increase  separation  to  15  centimeters.  (See  paragraph 
8.20.  for  more  information.) 
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Attachment  8 

FACILITY  ZONE  C,  EQUIPMENT  ZONE  A 

A8.1.  Introduction.  This  attachment  addresses  the  following  conditions: 

A8.1.1.  Facilities:  Assigned  Zone  C,  or  more  than  100  meters  of  inspectable  space. 

A8.1.2.  Equipment:  Assigned  Zone  A,  or  the  ERTZ  equal  to  1  meter  or  less,  or  meets  NSTISSAM/ 
TEMPEST  1-92,  Eevel  I  standards. 

A8.2.  Countermeasure  Application. 

A8.2.1.  Review  the  need  for  each  required  countermeasure.  Select  it  if  it  is  needed. 

A8.2.2.  Review  the  need  for  each  considered  countermeasure.  Do  not  select  it  unless  it  is  needed. 

A8.2.3.  Eor  existing  facilities,  when  countermeasures  involving  BEACK  equipment,  BEACK  wire 
lines,  BEACK  power  lines,  and  fortuitous  conductors  cannot  be  met,  the  user  may  request  an  EMSEC 
test  to  determine  if  countermeasures  are  needed. 

A8.3.  Required  Countermeasures.  Select  each  required  countermeasure  unless  the  threat  at  which  the 
countermeasure  is  aimed  does  not  exist.  Explain  why  each  required  countermeasure  not  selected  was  not 
selected.  A  waiver  is  not  needed  for  any  deselected  required  countermeasure  since  the  requirement  for 
protection  has  been  met. 

A8.3.1.  Inspectable  Space.  This  countermeasure  is  required.  Specify  the  minimum  inspectable  space 
(distance)  required  to  contain  radiated  compromising  emanations.  (See  paragraphs  8.4.  and  8.5.  for 
more  information.) 

A8.3.2.  RED  Equipment  and  BEACK  Equipment  Separation.  This  countermeasure  is  required  if 
BEACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space  unless:  (1)  the  line  distance  of 
the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines  are  fiber  optic;  and,  (2)  BEACK 
power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds 
100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See  paragraph  8.8.  for  more  information.) 

A8.3.2.1.  Do  not  place  BEACK  equipment  on  the  same  metal  desktop,  metal  bench  surface, 
metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment. 

A8.3.3.  RED  Equipment  and  BEACK  Wire  Eine  Separation.  This  countermeasure  is  required  for 
BEACK  wire  lines  that  exit  the  inspectable  space  unless  the  line  distance  of  the  BEACK  wire  lines 
from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  2,000  meters  or  if  the  BEACK  lines  are  fiber  optic.  (See  paragraph  8.9.  for  more  information.) 

A8.3.3.1.  Separate  RED  equipment  from  BEACK  wire  lines  by  0.5  meters. 

A8.3.3.1.1.  The  separation  distance  is  reduced  to  5  centimeters  if  the  BEACK  wire  lines  are 
shielded,  or, 

A8.3.3.1.2.  The  separation  distance  is  reduced  to  15  centimeters  if  a  BEACK  wire  line  isola¬ 
tion  countermeasure  is  used. 
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A8.3.3.2.  If  the  user  cannot  achieve  this  separation,  use  a  BLACK  wire  line  isolation  countermea¬ 
sure,  filter  BLACK  power  lines,  and  isolate  fortuitous  conductors. 

A8.3.4.  RED  Equipment  and  BEACK  Power  Eine  Separation.  This  countermeasure  is  required 
unless:  (1)  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  dis¬ 
tance  of  BEACK  wire  lines  connected  to  BEACK  equipment  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BEACK  lines 
are  fiber  optic.  (See  paragraph  8.10.  for  more  information.) 

A8.3.4.L  Separate  RED  equipment  from  BEACK  power  lines  by  0.5  meters. 

A8.3.4.LL  The  separation  distance  is  reduced  to  5  centimeters  if  the  BEACK  power  lines  are 
shielded. 

A8.3.4.L2.  If  the  user  cannot  achieve  this  separation,  use  a  BEACK  wire  line  isolation  coun¬ 
termeasure,  filter  BEACK  power  lines,  and  isolate  fortuitous  conductors. 

A8.3.5.  RED  Wire  Eine  and  BEACK  Wire  Eine  Separation.  This  countermeasure  is  required  if 
BEACK  wire  lines  exit  the  inspectable  space  unless  the  line  distance  of  the  BEACK  wire  lines  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than 
2,000  meters  or  if  the  BEACK  lines  are  fiber  optic.  (See  paragraph  8.17.  for  more  information.) 

A8.3.5.L  Separate  RED  wire  lines  from  BEACK  wire  lines  by  5  centimeters. 

A8.3.5.LL  Do  not  place  RED  and  BEACK  wire  lines  in  a  common  distribution  facility.  It  is 
permitted  to  use  a  common  distribution  facility  for  RED  and  BEACK  fiber  optic  signal  lines 
provided: 

A8.3.5. 1 . 1 . 1 .  Either  the  BEACK  or  the  RED  fiber  optic  signal  lines  in  a  RED  distribution 
facility  must  have  an  opaque  sheath.  BEACK  fiber  optic  signal  lines  should  not  have 
metallic  stiffeners  or  sheaths.  If  they  do,  treat  the  stiffeners  or  sheaths  as  fortuitous  conduc¬ 
tors  and  ground  both  ends  of  the  stiffeners  or  sheaths  if  the  BEACK  fiber  optic  signal  lines 
leave  the  inspectable  space. 

A8. 3. 5. 1.1. 2.  Separate  RED  fiber  optic  signal  lines  in  BEACK  distribution  facilities  from 
the  distribution  facility  before  the  distribution  facility  exits  the  inspectable  space. 

A8.3.5. 1.1.3.  Using  multifiber  bundle  for  both  RED  and  BEACK  signals  is  not  recom¬ 
mended.  If  used,  an  opaque  partition  between  the  RED  and  BEACK  fibers  is  required. 
Maintain  total  accountability  of  all  fibers  to  preclude  compromise  through  misconnection. 

A8.3.5.2.  When  RED  and  BEACK  wire  lines  are  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters. 

A8.3.6.  Shielded  RED  Wire  Eines.  This  countermeasure  is  required  for  RED  equipment  meeting  the 
requirements  of  NSTISSAM/TEMPEST  1-92,  Eevel  I,  which  must  use  optical  or  shielded  wire  cables 
if  specified  as  part  of  the  manufacturer’s  installation  specification  or  if  specified  for  compliance  with 
TEMPEST  certification.  (See  paragraph  8.23.  for  more  information.) 

A8.3.7.  Administrative  Communications  Countermeasures.  These  countermeasures  are  required: 
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A8.3.7.1.  BLACK  Telephone  Systems.  Do  not  place  the  telephone  instrument  on  the  same  metal 
desktop,  metal  bench  surface,  metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment.  (See  para¬ 
graph  8.52.  for  more  information.) 

A8.3.7.2.  BLACK  LANs.  (See  paragraph  8.54.  for  more  information.) 

A8.3.7.2.1.  Separate  RED  equipment  from  LAN  equipment  and  signal  wire  lines  as  required 
for  RED  equipment  and  BLACK  equipment  separation  and  RED  equipment  and  BLACK  wire 
line  separation  in  this  attachment. 

A8.3.7.2.2.  Separate  RED  wire  lines  from  LAN  signal  wire  lines  as  required  for  RED  wire 
line  and  BLACK  wire  line  separation  in  this  attachment. 

A8.3.8.  Timing  and  Control  Lines.  This  countermeasure  is  required.  Lollow  the  guidance  in  para¬ 
graph  8.59. 

A8.4.  Countermeasures  to  Consider.  Do  not  select  a  consider  countermeasure  unless  the  threat  at 
which  the  countermeasure  is  aimed  does  exist.  Explain  (justify)  why  a  not-required  (consider)  counter¬ 
measure  was  selected. 

A8.4. 1 .  RED  Equipment  and  BLACK  Equipment  Separation.  Consider  applying  this  countermeasure 
if  BLACK  wire  lines  connected  to  the  BLACK  equipment  exit  the  inspectable  space.  Do  not  select 
this  countermeasure  if:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the 
BLACK  lines  are  fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space 
up  to  a  point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 
If  selected,  separate  RED  equipment  from  BLACK  equipment  by  0.5  meters.  If  a  BLACK  wire  line 
isolation  countermeasure  is  used,  the  separation  distance  is  reduced  to  15  centimeters.  (See  paragraph 
8.8.  for  more  information.) 

A8.4.2.  RED  Wire  Line  and  BLACK  Equipment  Separation.  Consider  applying  this  countermeasure 
if  BLACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space.  Do  not  select  this  counter¬ 
measure  if  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BLACK  lines  are 
fiber  optic.  If  selected,  separate  RED  wire  lines  from  BLACK  equipment  by  0.5  meters.  If  a  BLACK 
wire  line  isolation  countermeasure  is  used,  the  separation  distance  is  reduced  to  15  centimeters.  (See 
paragraph  8.16.  for  more  information.) 

A8.4.3.  RED  Wire  Line  and  BLACK  Power  Line  Separation.  Consider  applying  this  countermeasure. 
Do  not  select  this  countermeasure  if:  (1)  BLACK  power  lines  are  contained  within  the  inspectable 
space  up  to  a  point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts 
potential;  and,  (2)  the  line  distance  of  the  BLACK  wire  line  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines 
are  fiber  optic.  If  selected,  separate  RED  wire  lines  from  BLACK  power  lines  by  5  centimeters.  If 
selected,  when  RED  wire  lines  and  BLACK  power  lines  are  run  parallel  for  30  meters  or  more, 
increase  the  separation  to  15  centimeters.  (See  paragraph  8.18.  for  more  information.) 
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Attachment  9 

FACILITY  ZONE  A,  EQUIPMENT  ZONE  B 

A9.1.  Introduction.  This  attachment  addresses  the  following  conditions: 

A9.1.1.  Facilities:  Assigned  Zone  A,  or  less  than  20  meters  of  inspectable  space. 

A9.1.2.  Equipment:  Assigned  Zone  B,  or  the  ERTZ  of  more  than  1  meter  but  less  than  20  meters,  or 
meets  NSTIS SAM/TEMPEST  1-92,  Eevel  II  standards. 

NOTE:  This  installation  may  cause  TEMPEST  hazards.  If  the  facility  is  TEMPEST  zoned  and  using 
TEMPEST- zoned  equipment,  contact  the  CTTA  to  evaluate  the  actual  TEMPEST  zone  test  results  for  the 
equipment  and  the  facility  to  determine  if  using  the  equipment  in  the  facility  is  possible. 

A9.2.  Countermeasure  Application. 

A9.2.1.  Review  the  need  for  each  required  countermeasure.  Select  it  if  it  is  needed. 

A9.2.2.  Review  the  need  for  each  consider  countermeasure.  Do  not  select  it  unless  it  is  needed. 

A9.2.3.  Eor  existing  facilities,  when  countermeasures  involving  BEACK  equipment,  BEACK  wire 
lines,  BEACK  power  lines,  and  fortuitous  conductors  cannot  be  met,  the  user  may  request  an  EMSEC 
test  to  determine  if  countermeasures  are  needed. 

A9.3.  Required  Countermeasures.  Select  each  required  countermeasure  unless  the  threat  at  which  the 
countermeasure  is  aimed  does  not  exist.  Explain  why  each  required  countermeasure  not  selected  was  not 
selected.  A  waiver  is  not  needed  for  any  deselected  required  countermeasure  since  the  requirement  for 
protection  has  been  met. 

A9.3.1.  Inspectable  Space.  This  countermeasure  is  required.  Specify  the  minimum  inspectable  space 
(distance)  required  to  contain  radiated  compromising  emanations.  (See  paragraphs  8.4.  and  8.5.  for 
more  information.) 

A9.3.2.  RED  Equipment  and  BEACK  Equipment  Separation.  This  countermeasure  is  required  if 
BEACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space  unless:  (1)  the  line  distance  of 
the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines  are  fiber  optic;  and  (2)  BEACK 
power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds 
100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See  paragraph  8.8.  for  more  information.) 

A9.3.2.1.  Separate  RED  equipment  from  BEACK  equipment  by  1  meter. 

A9.3.2.1.1.  The  separation  distance  is  reduced  to  15  centimeters  if  a  BEACK  wire  line  isola¬ 
tion  countermeasure  is  used. 

A9.3.2.1.2.  If  the  user  cannot  achieve  this  separation,  use  a  BEACK  wire  line  isolation  coun¬ 
termeasure,  filter  BEACK  power  lines,  and  isolate  fortuitous  conductors. 

A9.3.2.2.  Do  not  place  BEACK  equipment  on  the  same  metal  desktop,  metal  bench  surface, 
metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment. 

A9.3.3.  RED  Equipment  and  BEACK  Wire  Eine  Separation.  This  countermeasure  is  required  for 
BEACK  wire  lines  that  exit  the  inspectable  space  unless  the  line  distance  of  the  BEACK  wire  lines 
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from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  2,000  meters  or  if  the  BLACK  lines  are  fiber  optic.  (See  paragraph  8.9.  for  more  information.) 

A9.3.3.1.  Separate  RED  equipment  from  BLACK  wire  lines  by  1  meter. 

A9.3.3.1.1.  The  separation  distance  is  reduced  to  5  centimeters  if  the  BLACK  wire  lines  are 
shielded,  or, 

A9.3.3.1.2.  The  separation  distance  is  reduced  to  15  centimeters  if  a  BLACK  wire  line  isola¬ 
tion  countermeasure  is  used. 

A9.3.3.2.  If  the  user  cannot  achieve  this  separation,  use  a  BLACK  wire  line  isolation  countermea¬ 
sure,  filter  BLACK  power  lines,  and  isolate  fortuitous  conductors. 

A9.3.4.  RED  Equipment  and  BLACK  Power  Line  Separation.  This  countermeasure  is  required 
unless:  (1)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  dis¬ 
tance  of  BLACK  wire  lines  connected  to  BLACK  equipment  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines 
are  fiber  optic.  (See  paragraph  8.10.  for  more  information.) 

A9.3.4.1.  Separate  RED  equipment  from  BLACK  power  lines  by  1  meter. 

A9.3.4. 1.1.  The  separation  distance  is  reduced  to  5  centimeters  if  the  BLACK  power  lines  are 
shielded. 

A9.3.4.1.2.  If  the  user  cannot  achieve  this  separation,  use  a  BLACK  wire  line  isolation  coun¬ 
termeasure,  filter  BLACK  power  lines,  and  isolate  fortuitous  conductors. 

A9.3.5.  RED  Equipment  and  Lortuitous  Conductor  Separation.  This  countermeasure  is  required  for 
fortuitous  conductors  that  exit  the  inspectable  space,  BLACK  wires  that  exit  the  inspectable  space, 
and  BLACK  power  lines  unless:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the  building  con¬ 
taining  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  250  meters  or  the 
BLACK  lines  are  fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space 
up  to  a  point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 
(See  paragraph  8.12.  for  more  information.) 

A9.3.5.1.  Separate  RED  equipment  from  fortuitous  conductors  by  1  meter. 

A9.3.5.1.1.  If  the  user  cannot  achieve  this  separation,  use  a  BLACK  wire  line  isolation  coun¬ 
termeasure  and  isolate  fortuitous  conductors. 

A9.3.6.  RED  Wire  Line  and  BLACK  Wire  Line  Separation.  This  countermeasure  is  required  if 
BLACK  wire  lines  exit  the  inspectable  space  unless  the  line  distance  of  the  BLACK  wire  lines  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than 
2,000  meters  or  if  the  BLACK  lines  are  fiber  optic.  (See  paragraph  8.17.  for  more  information.) 

A9.3.6.1.  Separate  RED  wire  lines  from  BLACK  wire  lines  by  5  centimeters. 

A9.3.6.1.1.  Do  not  place  RED  and  BLACK  wire  lines  in  a  common  distribution  facility.  It  is 
permitted  to  use  a  common  distribution  facility  for  RED  and  BLACK  fiber  optic  signal  lines 
provided: 

A9.3.6. 1 .1.1.  Either  the  BLACK  or  the  RED  fiber  optic  signal  lines  in  a  RED  distribution 
facility  must  have  an  opaque  sheath.  BLACK  fiber  optic  signal  lines  should  not  have 
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metallic  stiffeners  or  sheaths.  If  they  do,  treat  the  stiffeners  or  sheaths  as  fortuitous  conduc¬ 
tors  and  ground  both  ends  of  the  stiffeners  or  sheaths  if  the  BLACK  fiber  optic  signal  lines 
leave  the  CAA. 

A9. 3. 6. 1.1. 2.  Separate  RED  fiber  optic  signal  lines  in  BLACK  distribution  facilities  from 
the  distribution  facility  before  the  distribution  facility  exits  the  inspectable  space. 

A9.3.6. 1.1.3.  Using  multifiber  bundle  for  both  RED  and  BLACK  signals  is  not  recom¬ 
mended.  If  used,  an  opaque  partition  between  the  RED  and  BLACK  fibers  is  required. 
Maintain  total  accountability  of  all  fibers  to  preclude  compromise  through  misconnection. 

A9.3.6.2.  When  RED  and  BLACK  wire  lines  are  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters. 

A9.3.7.  RED  Wire  Line  and  BLACK  Power  Line  Separation.  This  countermeasure  is  required  unless: 
(1)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average 
load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the 
BLACK  wire  line  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable 
space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  (See  paragraph  8.18.  for  more 
information.) 

A9.3.7.1.  Separate  RED  wire  lines  from  BLACK  power  lines  by  5  centimeters. 

A9.3.7.2.  When  RED  wire  lines  and  BLACK  power  lines  are  run  parallel  for  30  meters  or  more, 
increase  the  separation  to  15  centimeters. 

A9.3.8.  Shielded  RED  Wire  Lines.  This  countermeasure  is  required.  (See  paragraph  8.23.  for  more 
information.) 

A9.3.8.1.  Lor  TEMPEST- Certified  Equipment.  RED  equipment  meeting  the  requirements  of 
NSTISS AM/TEMPEST  1-92,  Level  I  must  use  optical  or  shielded  wire  cables  if  specified  as  part 
of  the  manufacturer’s  installation  specification  or  if  specified  for  compliance  with  TEMPEST  cer¬ 
tification. 

A9.3.8.2.  Eor  Non-TEMPEST-Certified  Equipment.  Shield  and  insulate  RED  wire  lines  even 
when  all  separation  distances  for  RED  equipment,  RED  wire  lines,  RED  power  lines,  RED  signal 
ground  wires,  and  BLACK  signal  ground  wires  from  BLACK  equipment,  BLACK  wire  lines, 
BLACK  power  lines,  and  fortuitous  conductors  that  exit  the  inspectable  space  are  met.  Attach¬ 
ment  18  contains  specifications  for  shielded  cables. 

A9.3.9.  RED  Power.  This  countermeasure  is  required  if  the  facility  contains  BLACK  equipment  with 
signal  wire  lines  that  exit  the  inspectable  space  unless:  (1)  the  line  distance  of  the  BLACK  wire  lines 
from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  1,000  meters;  or,  if  the  BLACK  lines  are  fiber  optic,  or,  a  BLACK  wire  line  isolation  counter¬ 
measure  is  used,  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See  para¬ 
graph  8.27.  for  more  information.) 

A9.3.9.1.  Do  not  power  TEMPEST-certified,  cryptographic  (unless  required  in  technical  manu¬ 
als),  or  BLACK  equipment  from  a  RED  power  circuit. 

A9.3.10.  Entered  RED  Power.  This  countermeasure  is  required  unless  the  power  lines  feeding  the 
facility  containing  the  RED  equipment  are  contained  within  the  inspectable  space  up  to  a  point  where 
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the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See  paragraph 
8.28.  for  more  information.) 

A9.3.10.1.  Do  not  power  TEMPEST-certified,  cryptographic  (unless  required  in  technical  manu¬ 
als),  or  BEACK  equipment  from  a  filtered  RED  power  circuit. 

A9.3.11.  Administrative  Communications  Countermeasures.  These  countermeasures  are  required: 

A9.3. 1 1.1.  BEACK  Telephone  Systems.  Do  not  place  the  telephone  instrument  on  the  same  metal 
desktop,  metal  bench  surface,  metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment.  (See  para¬ 
graph  8.52.  for  more  information.) 

A9.3.11.2.  BEACK  Intercom  and  Public  Address  Systems.  Use  paragraph  A21.2.1.  (See  para¬ 
graph  8.53.  for  more  information.) 

A9.3.11.3.  BEACK  EANs.  See  paragraph  8.54.  for  more  information. 

A9.3. 1 1.3.1.  Separate  RED  equipment  from  EAN  equipment  and  signal  wire  lines  as  required 
for  RED  equipment  and  BEACK  equipment  separation  and  RED  equipment  and  BEACK  wire 
line  separation  in  this  attachment. 

A9.3.11.3.2.  Separate  RED  wire  lines  from  EAN  signal  wire  lines  as  required  for  RED  wire 
line  and  BEACK  wire  line  separation  in  this  attachment. 

A9.3. 1 1 .4.  Comfort  Music  Systems.  Use  paragraph  A21.3.1.  (See  paragraph  8.55.  for  more  infor¬ 
mation.) 

A9.3.11.5.  BEACK  Cable  TV  Systems.  Use  paragraph  A21.4.1.  (See  paragraph  8.56.  for  more 
information.) 

A9.3. 1 1.5.1.  Separate  the  TV  set  from  RED  equipment  by  2  meters. 

A9.3.11.5.2.  Separate  video  cables  from  RED  equipment,  RED  wire  lines,  RED  power  lines, 
and  RED  signal  ground  wires  by  2  meters. 

A9.3.11.5.3.  Separate  active  splitters  or  amplifiers  from  RED  equipment,  RED  wire  lines, 
RED  power  lines,  and  RED  signal  ground  wires  by  2  meters. 

A9.3.11.6.  BEACK  TV-VCR  Systems.  Use  paragraph  A21.5.1.  Separate  the  BEACK  power  cord 
from  RED  equipment,  RED  wire  lines,  RED  power  lines,  and  RED  signal  ground  wires  by  2 
meters.  (See  paragraph  8.57.  for  more  information.) 

A9.3.12.  Timing  and  Control  Eines.  This  countermeasure  is  required.  Eollow  the  guidance  in  para¬ 
graph  8.59. 

A9.3.13.  Utility  Control  Cables.  This  countermeasure  is  required.  Eollow  the  guidance  in  paragraph 

8.60. 


A9.4.  Countermeasures  to  Consider.  Do  not  select  a  consider  countermeasure  unless  the  threat  at 
which  the  countermeasure  is  aimed  does  exist.  Explain  (justify)  why  a  not-required  (consider)  counter¬ 
measure  was  selected. 

NOTE:  When  making  the  countermeasures  review,  be  more  inclined  to  select  the  “consider”  counter¬ 
measures  in  paragraphs  A9.4.1.  through  A9.4.21.  if  the  inspectable  space  is  less  than  8  meters. 
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A9.4.1.  RED  Equipment  and  BEACK  Signal  Ground  Wire  Separation.  Consider  applying  this  coun¬ 
termeasure  if  BEACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if  the  line  distance 
of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  the  BEACK  lines  are  fiber  optic.  If  selected,  separate 
RED  equipment  from  BEACK  signal  ground  wires  by  1  meter.  If  a  BEACK  wire  line  isolation  coun¬ 
termeasure  is  used,  the  separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.11.  for  more 
information.) 

A9.4.2.  RED  Wire  Eine  and  BEACK  Equipment  Separation.  Consider  applying  this  countermeasure 
if  BEACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space.  Do  not  select  this  counter¬ 
measure  if  the  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines  are 
fiber  optic.  If  selected,  separate  RED  wire  lines  from  BEACK  equipment  by  1  meter.  If  a  BEACK 
wire  line  isolation  countermeasure  is  used,  the  separation  distance  is  reduced  to  15  centimeters.  (See 
paragraph  8.16.  for  more  information.) 

A9.4.3.  RED  Wire  Eine  and  BEACK  Signal  Ground  Wire  Separation.  Consider  applying  this  coun¬ 
termeasure  if  BEACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if  the  line  distance 
of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  the  BEACK  lines  are  fiber  optic.  If  selected,  separate 
RED  wire  lines  from  BEACK  signal  ground  wires  by  5  centimeters.  When  RED  wire  lines  run  paral¬ 
lel  to  BEACK  signal  ground  wires  for  30  meters  or  more,  increase  the  separation  to  15  centimeters. 
(See  paragraph  8.19.  for  more  information.) 

A9.4.4.  RED  Wire  Eine  and  Eortuitous  Conductor  Separation.  Consider  applying  this  countermea¬ 
sure  if  fortuitous  conductors  exit  the  inspectable  space.  Do  not  select  this  countermeasure  if:  (1)  the 
line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  bound¬ 
ary  of  the  inspectable  space  is  more  than  250  meters  or  the  BEACK  lines  are  fiber  optic;  or  (2) 
BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  RED  wire  lines 
from  fortuitous  conductors  by  5  centimeters.  When  RED  wire  lines  run  parallel  to  a  fortuitous  conduc¬ 
tor  for  30  meters  or  more  and  the  same  fortuitous  conductor  runs  parallel  to  BEACK  wire  lines  or 
BEACK  power  lines  for  30  meters  or  more,  increase  separation  to  15  centimeters.  (See  paragraph 
8.20.  for  more  information.) 

A9.4.5.  Shielded  BEACK  Wire  Eines.  Consider  applying  this  countermeasure  when  BEACK  wire 
lines  are  not  separated  by  the  required  distance  from  RED  equipment,  RED  wire  lines,  RED  power 
lines,  RED  signal  ground  wires,  BEACK  signal  ground  wires,  or  fortuitous  conductors.  (1)  Do  not 
select  this  countermeasure  if  the  required  separation  distance  for  RED  equipment,  RED  power  lines, 
RED  signal  ground  wires,  BEACK  signal  ground  wires,  or  fortuitous  conductors  from  BEACK  wire 
lines  is  not  met,  but,  the  line  distance  of  the  BEACK  wire  lines  connected  to  BEACK  equipment  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than 
1,000  meters  or  the  BEACK  lines  are  fiber  optic.  (2)  Do  not  select  this  countermeasure  if  the  required 
separation  distance  for  RED  wire  lines  from  BEACK  wire  lines  is  not  met,  but,  the  line  distance  of  the 
BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspect¬ 
able  space  is  greater  than  2,000  meters  or  the  BEACK  lines  are  fiber  optic.  Attachment  18  contains 
specifications  for  shielded  cables.  (See  paragraph  8.24.  for  more  information.) 
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A9.4.6.  RED  Power  Line  and  BLACK  Equipment  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  selected  and  BLACK  equipment  has  signal  wire  lines  that  exit  the  inspectable 
space.  Do  not  select  this  countermeasure  if:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the 
building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000 
meters,  if  the  BLACK  lines  are  fiber  optic,  or  a  BLACK  line  isolation  countermeasure  is  used;  and, 
(2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average 
load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  RED 
power  lines  from  BLACK  equipment  by  1  meter.  If  a  BLACK  wire  line  isolation  countermeasure  is 
used,  the  separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.29.  for  more  information.) 

A9.4.7.  RED  Power  Line  and  BLACK  Wire  Line  Separation.  Consider  applying  this  countermeasure 
if  RED  power  is  selected  and  BLACK  wire  lines  exit  the  inspectable  space.  Do  not  select  this  counter¬ 
measure  if  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BLACK  lines  are 
fiber  optic.  If  selected,  separate  RED  power  lines  from  BLACK  wire  lines  by  5  centimeters.  When 
RED  power  lines  and  BLACK  signal  ground  wires  are  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.30.  for  more  information.) 

A9.4.8.  RED  Power  Line  and  BLACK  Power  Line  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  selected.  Do  not  select  this  countermeasure  if:  (1)  BLACK  power  lines  are  con¬ 
tained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds  100,000 
volt- amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the  BLACK  wire  lines 
from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  1,000  meters  or  if  the  BLACK  lines  are  fiber  optic.  If  selected,  separate  RED  power  lines  from 
BLACK  power  lines  by  5  centimeters.  When  RED  power  lines  and  BLACK  power  lines  are  run  par¬ 
allel  for  30  meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph  8.31.  for  more 
information.) 

A9.4.9.  RED  Power  Line  and  BLACK  Signal  Ground  Wire  Separation.  Consider  applying  this  coun¬ 
termeasure  if  the  RED  power  and  BLACK  signal  ground  countermeasures  are  selected.  Do  not  select 
this  countermeasure  if:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK 
lines  are  fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a 
point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If 
selected,  separate  RED  power  lines  from  BLACK  signal  ground  wires  by  5  centimeters.  When  RED 
power  lines  and  BLACK  signal  ground  wires  are  run  parallel  for  30  meters  or  more,  increase  the  sep¬ 
aration  to  15  centimeters.  (See  paragraph  8.32.  for  more  information.) 

A9.4. 10.  RED  Power  Line  and  Lortuitous  Conductor  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  selected  and  fortuitous  conductors  exit  the  inspectable  space.  Do  not  select  this 
countermeasure  if:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines 
are  fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  power  lines  from  fortuitous  conductors  by  5  centimeters.  When  RED  power  lines  run 
parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortuitous  conductor  and 
BLACK  wire  lines  or  BLACK  power  lines  run  parallel  for  30  meters  or  more,  increase  the  separation 
to  15  centimeters.  (See  paragraph  8.33.  for  more  information.) 
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A9.4. 1 1 .  RED  Signal  Ground.  Consider  applying  this  countermeasure  if  RED  equipment  needs  a  sig¬ 
nal  ground,  RED  power  filters  are  installed,  cryptographic  equipment  is  installed  in  facility,  or  RED 
wire  lines  are  shielded.  Do  not  select  this  countermeasure  if  the  facility  is  completely  contained  within 
the  inspectable  space.  (See  paragraph  8.35.  for  more  information.) 

A9.4.12.  BEACK  Signal  Ground.  Consider  applying  this  countermeasure  if  BEACK  wire  line  filters 
or  cryptographic  equipment  is  installed  in  the  facility  or  BEACK  wire  lines  are  shielded.  (See  para¬ 
graph  8.35.  for  more  information.) 

A9.4.12.1.  Do  not  select  this  countermeasure  if  the  facility  is  completely  contained  within  the 

inspectable  space. 

A9.4.12.2.  Do  not  use  BEACK  signal  ground  as  the  signal  ground  for  BEACK  equipment; 

BEACK  signal  ground  carries  compromising  emanations. 

A9.4. 13.  RED  Signal  Ground  Wire  and  BEACK  Equipment  Separation.  Consider  applying  this  coun¬ 
termeasure  if  a  RED  signal  ground  is  selected  and  BEACK  equipment  has  signal  wire  lines  which  exit 
the  inspectable  space.  Do  not  select  this  countermeasure  if:  (1)  the  line  distance  of  the  BEACK  wire 
lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is 
greater  than  1,000  meters  or  if  the  BEACK  lines  are  fiber  optic;  and,  (2)  BEACK  power  lines  are  con¬ 
tained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds  100,000 
volt-amperes  and  at  least  10,000  volts  potential..  Do  not  select  this  countermeasure  if  the  facility  is 
completely  contained  within  the  inspectable  space.  If  selected,  separate  RED  signal  ground  wires 
from  BEACK  equipment  by  1  meter.  If  a  BEACK  wire  line  isolation  countermeasure  is  used,  the  sep¬ 
aration  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.36.  for  more  information.) 

A9.4.14.  RED  Signal  Ground  Wire  and  BEACK  Wire  Eine  Separation.  Consider  applying  this  coun¬ 
termeasure  if  a  RED  signal  ground  is  selected  and  BEACK  wire  lines  exit  the  inspectable  space.  Do 
not  select  this  countermeasure  if  the  line  distance  of  the  BEACK  wire  lines  from  the  building  contain¬ 
ing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  2,000  meters  or  if  the 
BEACK  lines  are  fiber  optic.  If  selected,  separate  RED  signal  ground  wires  from  BEACK  wire  lines 
by  5  centimeters.  When  RED  signal  ground  wires  run  parallel  to  BEACK  wire  lines  for  30  meters  or 
more,  increase  the  separation  to  15  centimeters.  (See  paragraph  8.37.  for  more  information.) 

A9.4.15.  RED  Signal  Ground  Wire  and  BEACK  Power  Eine  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1)  BEACK 
power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds 
100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the  BEACK  wire 
lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is 
greater  than  1,000  meters  or  the  BEACK  lines  are  fiber  optic.  If  selected,  separate  RED  signal  ground 
wires  from  BEACK  power  lines  by  5  centimeters.  When  RED  signal  ground  wires  run  parallel  to 
BEACK  power  lines  for  30  meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph 
8.38.  for  more  information.) 

A9.4.16.  RED  Signal  Ground  Wire  and  BEACK  Signal  Ground  Wire  Separation.  Consider  applying 
this  countermeasure  if  RED  and  BEACK  signal  grounds  are  selected.  Do  not  select  this  countermea¬ 
sure  if:  (1)  the  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BEACK  lines  are 
fiber  optic;  and,  (2)  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected. 
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separate  RED  signal  ground  wires  from  BLACK  signal  ground  wires  by  5  centimeters.  When  RED 
signal  ground  wires  run  parallel  to  BLACK  signal  ground  wires  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.39.  for  more  information.) 

A9.4.17.  RED  Signal  Ground  Wire  and  Eortuitous  Conductor  Separation.  Consider  applying  this 
countermeasure  if  RED  signal  ground  is  selected  and  fortuitous  conductors  exit  the  inspectable  space. 
Do  not  select  this  countermeasure  if:  (1)  BLACK  wire  lines  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines  are 
fiber  optic;  or,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where 
the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate 
RED  signal  ground  wires  from  fortuitous  conductor  by  5  centimeters.  When  RED  signal  ground  wires 
run  parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortuitous  conductor  and 
BLACK  wire  lines  or  BLACK  power  lines  run  parallel  for  30  meters  or  more,  increase  the  separation 
to  15  centimeters.  (See  paragraph  8.40.  for  more  information.) 

A9.4.18.  BLACK  Signal  Ground  Wire  and  BLACK  Equipment  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1)  the  line 
distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary 
of  the  inspectable  space  is  more  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic;  and,  (2) 
BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  BLACK  signal 
ground  wires  from  BLACK  equipment  by  1  meter.  If  a  BLACK  wire  line  isolation  countermeasure  is 
used,  the  separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.41.  for  more  information.) 

A9.4.19.  BLACK  Signal  Ground  Wire  and  BLACK  Wire  Line  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if  the  line  dis¬ 
tance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of 
the  inspectable  space  is  greater  than  2,000  meters  or  if  the  BLACK  lines  are  fiber  optic.  If  selected, 
separate  BLACK  signal  ground  wires  from  BLACK  wire  lines  by  5  centimeters.  When  a  BLACK  sig¬ 
nal  ground  wire  runs  parallel  to  a  BLACK  wire  line  for  30  meters  or  more,  increase  the  separation  to 
15  centimeters.  (See  paragraph  8.42.  for  more  information.) 

A9.4.20.  BLACK  Signal  Ground  Wire  and  BLACK  Power  Line  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1) 
BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt- amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the 
BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspect¬ 
able  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  If  selected,  separate 
BLACK  signal  ground  wires  from  BLACK  power  lines  by  5  centimeters.  When  a  BLACK  signal 
ground  wire  runs  parallel  to  a  BLACK  power  line  for  30  meters  or  more,  increase  the  separation  to  15 
centimeters.  (See  paragraph  8.43.  for  more  information.) 

A9.4.21.  BLACK  Signal  Ground  Wire  and  Eortuitous  Conductor  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected  and  fortuitous  conductors  exit  the  inspectable 
space.  Do  not  select  this  countermeasure  if:  (1)  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines 
are  fiber  optic;  or,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  BLACK  signal  ground  wires  from  fortuitous  conductors  by  5  centimeters.  When  BLACK 
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signal  ground  wires  run  parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortu¬ 
itous  conductor  and  BLACK  wire  lines  or  BLACK  power  lines  run  parallel  for  30  meters  or  more, 
increase  the  separation  to  15  centimeters.  (See  paragraph  8.44.  for  more  information.) 
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Attachment  10 

FACILITY  ZONE  B,  EQUIPMENT  ZONE  B 

AlO.l.  Introduction.  This  attachment  addresses  the  following  conditions: 

AIO.1.1.  Facilities:  Assigned  Zone  B,  or  more  than  20  meters  but  less  than  100  meters  of  inspectable 
space. 

AlO.l. 2.  Equipment:  Assigned  Zone  B,  or  the  ERTZ  equal  to  1  to  20  meters,  or  meets  NSTISSAM/ 
TEMPEST  1-92,  Eevel  II  standards. 

AI0.2.  Countermeasure  Application. 

A 10. 2. 1.  Review  the  need  for  each  required  countermeasure.  Select  it  if  it  is  needed. 

AIO.2.2.  Review  the  need  for  each  consider  countermeasure.  Do  not  select  it  unless  it  is  needed. 

AIO.2.3.  Eor  existing  facilities,  when  countermeasures  involving  BEACK  equipment,  BEACK  wire 
lines,  BEACK  power  lines,  and  fortuitous  conductors  cannot  be  met,  the  user  may  request  an  EMSEC 
test  to  determine  if  countermeasures  are  needed. 

AI0.3.  Required  Countermeasures.  Select  each  required  countermeasure  unless  the  threat  at  which  the 
countermeasure  is  aimed  does  not  exist.  Explain  why  each  required  countermeasure  not  selected  was  not 
selected.  A  waiver  is  not  needed  for  any  deselected  required  countermeasure  since  the  requirement  for 
protection  has  been  met. 

AIO.3.1.  Inspectable  Space.  This  countermeasure  is  required.  Specify  the  minimum  inspectable 
space  (distance)  required  to  contain  radiated  compromising  emanations.  (See  paragraphs  8.4.  and  8.5. 
for  more  information.) 

AIO.3.2.  RED  Equipment  and  BEACK  Equipment  Separation.  This  countermeasure  is  required  if 
BEACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space  unless:  (1)  the  line  distance  of 
the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines  are  fiber  optic;  and,  (2)  BEACK 
power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds 
100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See  paragraph  8.8.  for  more  information.) 

AIO.3.2.1.  Separate  RED  equipment  from  BEACK  equipment  by  0.5  meters. 

AIO.3.2.1.1.  The  separation  distance  is  reduced  to  15  centimeters  if  a  BEACK  wire  line  isola¬ 
tion  countermeasure  is  used. 

AIO.3.2. 1.2.  If  the  user  cannot  achieve  this  separation,  use  a  BEACK  wire  line  isolation  coun¬ 
termeasure,  filter  BEACK  power  lines,  and  isolate  fortuitous  conductors. 

AIO.3.2.2.  Do  not  place  BEACK  equipment  on  the  same  metal  desktop,  metal  bench  surface, 
metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment. 

AIO.3.3.  RED  Equipment  and  BEACK  Wire  Eine  Separation.  This  countermeasure  is  required  for 
BEACK  wire  lines  that  exit  the  inspectable  space  unless  the  line  distance  of  the  BEACK  wire  lines 
from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  2,000  meters  or  if  the  BEACK  lines  are  fiber  optic.  (See  paragraph  8.9.  for  more  information.) 
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AIO.3.3.1.  Separate  RED  equipment  from  BLACK  wire  lines  by  1  meter. 

AIO.3.3.1.1.  The  separation  distance  is  reduced  to  5  centimeters  if  the  BLACK  wire  lines  are 
shielded,  or, 

AIO.3.3.1.2.  The  separation  distance  is  reduced  to  15  centimeters  if  a  BLACK  wire  line  isola¬ 
tion  countermeasure  is  used. 

AIO.3.3.2.  If  the  user  cannot  achieve  this  separation,  use  a  BLACK  wire  line  isolation  counter¬ 
measure,  filter  BLACK  power  lines,  and  isolate  fortuitous  conductors. 

AIO.3.4.  RED  Equipment  and  BLACK  Power  Line  Separation.  This  countermeasure  is  required 
unless:  (1)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  dis¬ 
tance  of  BLACK  wire  lines  connected  to  BLACK  equipment  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines 
are  fiber  optic.  (See  paragraph  8.10.  for  more  information.) 

AIO.3.4.1.  Separate  RED  equipment  from  BLACK  power  lines  by  1  meter. 

AIO.3.4.1.1.  The  separation  distance  is  reduced  to  5  centimeters  if  the  BLACK  power  lines 
are  shielded, 

AIO.3.4. 1.2.  If  the  user  cannot  achieve  this  separation,  use  a  BLACK  wire  line  isolation  coun¬ 
termeasure,  filter  BLACK  power  lines,  and  isolate  fortuitous  conductors. 

AIO.3.5.  RED  Wire  Line  and  BLACK  Wire  Line  Separation.  This  countermeasure  is  required  if 
BLACK  wire  lines  exit  the  inspectable  space  unless  the  line  distance  of  the  BLACK  wire  lines  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than 
2,000  meters  or  if  the  BLACK  lines  are  fiber  optic.  (See  paragraph  8.17.  for  more  information.) 

AIO.3.5.1.  Separate  RED  wire  lines  from  BLACK  wire  lines  by  5  centimeters. 

AIO.3.5. 1 . 1 .  Do  not  place  RED  and  BLACK  wire  lines  in  a  common  distribution  facility.  It  is 
permitted  to  use  a  common  distribution  facility  for  RED  and  BLACK  fiber  optic  signal  lines 
provided: 

AIO.3.5.1.1.1.  Either  the  BLACK  or  the  RED  fiber  optic  signal  lines  in  a  RED  distribu¬ 
tion  facility  must  have  an  opaque  sheath.  BLACK  fiber  optic  signal  lines  should  not  have 
metallic  stiffeners  or  sheaths.  If  they  do,  treat  the  stiffeners  or  sheaths  as  fortuitous  conduc¬ 
tors  and  ground  both  ends  of  the  stiffeners  or  sheaths  if  the  BLACK  fiber  optic  signal  lines 
leave  the  inspectable  space. 

AIO.3.5.1.1.2.  Separate  RED  fiber  optic  signal  lines  in  BLACK  distribution  facilities 
from  the  distribution  facility  before  the  distribution  facility  exits  the  inspectable  space. 

AIO.3.5.1.1.3.  Using  multifiber  bundle  for  both  RED  and  BLACK  signals  is  not  recom¬ 
mended.  If  used,  an  opaque  partition  between  the  RED  and  BLACK  fibers  is  required. 
Maintain  total  accountability  of  all  fibers  to  preclude  compromise  through  misconnection. 

AIO.3.5.2.  When  RED  and  BLACK  wire  lines  are  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters. 

AIO.3.6.  RED  Wire  Line  and  BLACK  Power  Line  Separation.  This  countermeasure  is  required 
unless:  (1)  the  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
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average  load  exceeds  100,000  volt- amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  dis¬ 
tance  of  the  BLACK  wire  line  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  (See  paragraph 
8.18.  for  more  information.) 

AIO.3.6.1.  Separate  RED  wire  lines  from  BLACK  power  lines  by  5  centimeters. 

AIO.3.6.2.  When  RED  wire  lines  and  BLACK  power  lines  are  run  parallel  for  30  meters  or  more, 
increase  the  separation  to  15  centimeters. 

A 10. 3. 7.  Shielded  RED  Wire  Lines.  This  countermeasure  is  required  for  RED  equipment  meeting  the 
requirements  of  NSTISSAM/TEMPEST  1-92,  Level  I,  which  must  use  optical  or  shielded  wire  cables 
if  specified  as  part  of  the  manufacturer’s  installation  specification  or  if  specified  for  compliance  with 
TEMPEST  certification.  (See  paragraph  8.23.  for  more  information.) 

AIO.3.8.  RED  Power.  This  countermeasure  is  required  if  the  facility  contains  BLACK  equipment 
with  signal  wire  lines  that  exit  the  inspectable  space  unless:  (1)  the  line  distance  of  the  BLACK  wire 
lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is 
greater  than  1,000  meters  or  if  the  BLACK  lines  are  fiber  optic,  or,  a  BLACK  wire  line  isolation  coun¬ 
termeasure  is  used;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a 
point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See 
paragraph  8.27.  for  more  information.) 

AIO.3.8.1.  Do  not  power  TEMPEST-certified,  cryptographic  (unless  required  in  technical  manu¬ 
als),  or  BLACK  equipment  from  a  RED  power  circuit. 

AIO.3.9.  Administrative  Communications  Countermeasures.  These  countermeasures  are  required. 

AIO.3.9. 1 .  BLACK  Telephone  Systems.  Do  not  place  the  telephone  instrument  on  the  same  metal 
desktop,  metal  bench  surface,  metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment.  (See  para¬ 
graph  8.52.  for  more  information.) 

AIO.3.9.2.  BLACK  LANs.  (See  paragraph  8.54.  for  more  information.) 

AIO.3.9.2. 1 .  Separate  RED  equipment  from  LAN  equipment  and  signal  wire  lines  as  required 
for  RED  equipment  and  BLACK  equipment  separation  and  RED  equipment  and  BLACK  wire 
line  separation  in  this  attachment. 

AIO.3.9.2.2.  Separate  RED  wire  lines  from  LAN  signal  wire  lines  as  required  for  RED  wire 
line  and  BLACK  wire  line  separation  in  this  attachment. 

AIO.3.10.  Timing  and  Control  Lines.  This  countermeasure  is  required.  Lollow  the  guidance  in  para¬ 
graph  8.59. 

A 10. 3. 11.  Utility  Control  Cables.  This  countermeasure  is  required.  Lollow  the  guidance  in  paragraph 

8.60. 


A10.4.  Countermeasures  to  Consider.  Do  not  select  a  consider  countermeasure  unless  the  threat  at 
which  the  countermeasure  is  aimed  does  exist.  Explain  (justify)  why  a  not-required  (consider)  counter¬ 
measure  was  selected. 

A  10.4. 1 .  RED  Equipment  and  BLACK  Signal  Ground  Wire  Separation.  Consider  applying  this  coun¬ 
termeasure  if  BLACK  wire  lines  are  shielded  or  filtered.  Do  not  select  this  countermeasure  if  the  line 
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distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary 
of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic  If  selected, 
separate  RED  equipment  from  BLACK  signal  ground  wires  by  0.5  meters.  If  selected,  the  separation 
distance  is  reduced  to  15  centimeters  if  a  BLACK  wire  line  isolation  countermeasure  is  used.  If  a 
BLACK  wire  line  isolation  countermeasure  is  used,  the  separation  distance  is  reduced  to  15  centime¬ 
ters.  (See  paragraph  8.11.  for  more  information.) 

AIO.4.2.  RED  Wire  Line  and  BLACK  Equipment  Separation.  Consider  applying  this  countermea¬ 
sure  if  BLACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space.  Do  not  select  this 
countermeasure  if  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BLACK  lines 
are  fiber  optic.  If  selected,  separate  RED  wire  lines  from  BLACK  equipment  by  0.5  meters.  If  a 
BLACK  wire  line  isolation  countermeasure  is  used,  the  separation  distance  is  reduced  to  15  centime¬ 
ters.  (See  paragraph  8.16.  for  more  information.) 

AIO.4.3.  RED  Wire  Line  and  BLACK  Signal  Ground  Wire  Separation.  Consider  applying  this  coun¬ 
termeasure  if  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are 
fiber  optic  If  selected,  separate  RED  wire  lines  from  BLACK  signal  ground  wires  by  5  centimeters. 
When  RED  wire  lines  run  parallel  to  BLACK  signal  ground  wires  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.19.  for  more  information.) 

A  10.4.4.  RED  Wire  Line  and  Lortuitous  Conductor  Separation.  Consider  applying  this  countermea¬ 
sure  if  fortuitous  conductors  exit  the  inspectable  space.  Do  not  select  this  countermeasure  if:  (1)  the 
line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  bound¬ 
ary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines  are  fiber  optic;  or  (2) 
BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  RED  wire  lines 
from  fortuitous  conductors  by  5  centimeters.  When  RED  wire  lines  run  parallel  to  a  fortuitous  conduc¬ 
tor  for  30  meters  or  more  and  the  same  fortuitous  conductor  runs  parallel  to  BLACK  wire  lines  or 
BLACK  power  lines  for  30  meters  or  more,  increase  separation  to  15  centimeters.  (See  paragraph 
8.20.  for  more  information.) 

AIO.4.5.  Shielded  BLACK  Wire  Lines.  Consider  applying  this  countermeasure  when  BLACK  wire 
lines  are  not  separated  by  the  required  distance  from  RED  equipment,  RED  wire  lines,  RED  power 
lines,  RED  signal  ground  wires,  BLACK  signal  ground  wires,  or  fortuitous  conductors.  (1)  Do  not 
select  this  countermeasure  if  the  required  separation  distance  for  RED  equipment,  RED  power  lines, 
RED  signal  ground  wires,  BLACK  signal  ground  wires,  or  fortuitous  conductors  from  BLACK  wire 
lines  is  not  met,  but,  the  line  distance  of  the  BLACK  wire  lines  connected  to  BLACK  equipment  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than 
1,000  meters  or  the  BLACK  lines  are  fiber  optic.  (2)  Do  not  select  this  countermeasure  if  the  required 
separation  distance  for  RED  wire  lines  from  BLACK  wire  lines  is  not  met,  but,  the  line  distance  of  the 
BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspect¬ 
able  space  is  greater  than  2,000  meters  or  the  BLACK  lines  are  fiber  optic.  Attachment  18  contains 
specifications  for  shielded  cables.  (See  paragraph  8.24.  for  more  information.) 

AIO.4.5.1.  If  the  selection  of  this  countermeasure  concerns  fortuitous  conductors,  do  not  apply  it 

unless  RED  wire  lines,  RED  signal  ground  wires,  or  BLACK  signal  ground  wires  run  parallel 
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within  5  centimeters  of  a  fortuitous  eonduetor  for  30  meters  or  more,  and,  BLACK  wire  lines  also 
run  parallel  within  5  centimeters  of  the  same  fortuitous  conductor  for  30  meters  or  more. 

AIO.4.5.2.  This  eountermeasure  is  not  needed  if  there  is  at  least  1  meter  separation  between  a  par¬ 
allel  RED  wire  line  and  a  BLACK  wire  line  or  a  eommon  fortuitous  eonduetor  run. 

AIO.4.6.  Filtered  RED  Power.  Consider  applying  this  countermeasure  if  RED  power  is  required.  Do 
not  select  this  countermeasure  if  the  power  lines  feeding  the  RED  power  cireuit  are  eontained  within 
the  inspectable  spaee  up  to  a  point  where  the  average  load  exeeeds  100,000  volt- amperes  and  at  least 
10,000  volts  potential.  (See  paragraph  8.28.  for  more  information.) 

AIO.4.6.1.  If  selected,  do  not  power  TEMPEST-certified,  cryptographie  (unless  required  in  tech- 
nieal  manuals),  or  BLACK  equipment  from  a  filtered  RED  power  cireuit. 

A  10.4.7.  RED  Power  Line  and  BLACK  Equipment  Separation.  Consider  applying  this  eountermea¬ 
sure  if  RED  power  is  selected  and  BLACK  equipment  has  signal  wire  lines  that  exit  the  inspeetable 
space.  Do  not  select  this  countermeasure  if:  (1)  the  line  distanee  of  the  BLACK  wire  lines  from  the 
building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000 
meters,  the  BLACK  lines  are  fiber  optie,  or  a  BLACK  line  isolation  countermeasure  is  used;  and,  (2) 
BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exeeeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  seleeted,  separate  RED  power 
lines  from  BLACK  equipment  by  0.5  meters.  If  a  BLACK  wire  line  isolation  eountermeasure  is  used, 
the  separation  distance  is  redueed  to  15  eentimeters.  (See  paragraph  8.29.  for  more  information.) 

AIO.4.8.  RED  Power  Line  and  BLACK  Wire  Line  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  seleeted  and  BLACK  wire  lines  exit  the  inspeetable  spaee.  Do  not  seleet  this 
eountermeasure  if  the  line  distanee  of  the  BLACK  wire  lines  from  the  building  eontaining  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BLACK  lines 
are  fiber  optic.  If  selected,  separate  RED  power  lines  from  BLACK  wire  lines  by  5  centimeters.  When 
RED  power  lines  and  BLACK  signal  ground  wires  are  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  eentimeters.  (See  paragraph  8.30.  for  more  information.) 

AIO.4.9.  RED  Power  Line  and  BLACK  Power  Line  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  selected.  Do  not  select  this  countermeasure  if:  (1)  BLACK  power  lines  are  eon¬ 
tained  within  the  inspeetable  spaee  up  to  a  point  where  the  average  load  exeeeds  100,000 
volt- amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distanee  of  the  BLACK  wire  lines 
from  the  building  eontaining  the  RED  equipment  to  the  boundary  of  the  inspeetable  spaee  is  greater 
than  1,000  meters  or  if  the  BLACK  lines  are  fiber  optic.  If  selected,  separate  RED  power  lines  from 
BLACK  power  lines  by  5  centimeters.  When  RED  power  lines  and  BLACK  power  lines  are  run  par¬ 
allel  for  30  meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph  8.31.  for  more 
information.) 

AIO.4.10.  RED  Power  Line  and  BLACK  Signal  Ground  Wire  Separation.  Consider  applying  this 
countermeasure  if  RED  power  and  BLACK  signal  ground  are  selected.  Do  not  select  this  countermea¬ 
sure  if:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the  building  eontaining  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspeetable  spaee  is  greater  than  1,000  meters  or  the  BLACK  lines  are 
fiber  optie;  and,  (2)  BLACK  power  lines  are  eontained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  power  lines  from  BLACK  signal  ground  wires  by  5  centimeters.  When  RED  power 
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lines  and  BLACK  signal  ground  wires  are  run  parallel  for  30  meters  or  more,  increase  the  separation 
to  15  centimeters.  (See  paragraph  8.32.  for  more  information.) 

AIO.4.11.  RED  Power  Line  and  Fortuitous  Conductor  Separation.  Consider  applying  this  counter¬ 
measure  if  RED  power  is  selected  and  fortuitous  conductors  exit  the  inspectable  space.  Do  not  select 
this  countermeasure  if:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines 
are  fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  power  lines  from  fortuitous  conductors  by  5  centimeters.  When  RED  power  lines  run 
parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortuitous  conductor  and 
BLACK  wire  lines  or  BLACK  power  lines  run  parallel  for  30  meters  or  more,  increase  the  separation 
to  15  centimeters.  (See  paragraph  8.33.  for  more  information.) 

AIO.4.12.  RED  Signal  Ground.  Consider  applying  this  countermeasure  if  RED  equipment  needs  a 
signal  ground,  RED  power  filters  are  installed,  cryptographic  equipment  is  installed  in  the  facility,  or 
RED  wire  lines  are  shielded.  Do  not  select  this  countermeasure  if  the  facility  is  completely  contained 
within  the  inspectable  space.  (See  paragraph  8.35.  for  more  information.) 

AIO.4.13.  BLACK  Signal  Ground.  Consider  applying  this  countermeasure  if  BLACK  wire  line  fil¬ 
ters  or  cryptographic  equipment  is  installed  in  the  facility  or  BLACK  wire  lines  are  shielded.  (See 
paragraph  8.35.  for  more  information.) 

AIO.4.13.1.  Do  not  select  this  countermeasure  if  the  facility  is  completely  contained  within  the 

inspectable  space. 

AIO.4.13.2.  Do  not  use  BLACK  signal  ground  as  the  signal  ground  for  BLACK  equipment; 

BLACK  signal  ground  carries  compromising  emanations. 

AIO.4.14.  RED  Signal  Ground  Wire  and  BLACK  Equipment  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected  and  BLACK  equipment  has  signal  wire  lines  that 
exit  the  inspectable  space.  Do  not  select  this  countermeasure  if:  (1)  the  line  distance  of  the  BLACK 
wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space 
is  greater  than  1,000  meters  or  if  the  BLACK  lines  are  fiber  optic;  and,  (2)  BLACK  power  lines  are 
contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds  100,000 
volt-amperes  and  at  least  10,000  volts  potential.  Do  not  select  this  countermeasure  if  the  facility  is 
completely  contained  within  the  inspectable  space.  If  selected,  separate  RED  signal  ground  wires 
from  BLACK  equipment  by  0.5  meters.  If  a  BLACK  wire  line  isolation  countermeasure  is  used,  the 
separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.36.  for  more  information.) 

AIO.4.15.  RED  Signal  Ground  Wire  and  BLACK  Wire  Line  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected  and  BLACK  wire  lines  exit  the  inspectable  space. 
Do  not  select  this  countermeasure  if  the  line  distance  of  the  BLACK  wire  lines  from  the  building  con¬ 
taining  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  2,000  meters  or  if 
the  BLACK  lines  are  fiber  optic.  If  selected,  separate  RED  signal  ground  wires  from  BLACK  wire 
lines  by  5  centimeters.  When  RED  signal  ground  wires  run  parallel  to  BLACK  wire  lines  for  30 
meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph  8.37.  for  more  information.) 

AIO.4.16.  RED  Signal  Ground  Wire  and  BLACK  Power  Line  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1)  BLACK 
power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds 
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100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distanee  of  the  BLACK  wire 
lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is 
greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  If  selected,  separate  RED  signal  ground 
wires  from  BLACK  power  lines  by  5  centimeters.  When  RED  signal  ground  wires  run  parallel  to 
BLACK  power  lines  for  30  meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph 
8.38.  for  more  information.) 

A10.4. 17.  RED  Signal  Ground  Wire  and  BLACK  Signal  Ground  Wire  Separation.  Consider  applying 
this  countermeasure  if  RED  and  BLACK  signal  ground  are  selected.  Do  not  select  this  countermea¬ 
sures  if:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are 
fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  signal  ground  wires  from  BLACK  signal  ground  wires  by  5  centimeters.  When  RED 
signal  ground  wires  run  parallel  to  BLACK  signal  ground  wires  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.39.  for  more  information.) 

AIO.4.18.  RED  Signal  Ground  Wire  and  Lortuitous  Conductor  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected  and  fortuitous  conductors  exit  the  inspectable 
space.  Do  not  select  this  countermeasure  if:  (1)  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines 
are  fiber  optic;  or,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  signal  ground  wires  from  fortuitous  conductors  by  5  centimeters.  When  RED  signal 
ground  wires  run  parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortuitous  con¬ 
ductor  and  BLACK  wire  lines  or  BLACK  power  lines  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.40.  for  more  information.) 

AIO.4.19.  BLACK  Signal  Ground  Wire  and  BLACK  Equipment  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1)  the  line 
distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary 
of  the  inspectable  space  is  more  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic;  and,  (2) 
BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  BLACK  signal 
ground  wires  from  BLACK  equipment  by  0.5  meters.  If  a  BLACK  wire  line  isolation  countermeasure 
is  used,  the  separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.41.  for  more  informa¬ 
tion.) 

AIO.4.20.  BLACK  Signal  Ground  Wire  and  BLACK  Wire  Line  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if  the  line  dis¬ 
tance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of 
the  inspectable  space  is  greater  than  2,000  meters  or  if  the  BLACK  lines  are  fiber  optic.  If  selected, 
separate  BLACK  signal  ground  wires  from  BLACK  wire  lines  by  5  centimeters.  When  a  BLACK  sig¬ 
nal  ground  wire  runs  parallel  to  a  BLACK  wire  line  for  30  meters  or  more,  increase  the  separation  to 
15  centimeters.  (See  paragraph  8.42.  for  more  information.) 

AIO.4.21.  BLACK  Signal  Ground  Wire  and  BLACK  Power  Line  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1) 
BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
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exceeds  100,000  volt- amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the 
BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspect- 
able  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  If  selected,  separate 
BLACK  signal  ground  wires  from  BLACK  power  lines  by  5  centimeters.  When  a  BLACK  signal 
ground  wire  runs  parallel  to  a  BLACK  power  line  for  30  meters  or  more,  increase  the  separation  to  15 
centimeters.  (See  paragraph  8.43.  for  more  information.) 

AIO.4.22.  BLACK  Signal  Ground  Wire  and  Lortuitous  Conductor  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected  and  fortuitous  conductors  exit  the  inspectable 
space.  Do  not  select  this  countermeasure  if:  (1)  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines 
are  fiber  optic;  or,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  BLACK  signal  ground  wires  from  fortuitous  conductors  by  5  centimeters.  When  BLACK 
signal  ground  wires  run  parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortu¬ 
itous  conductor  and  BLACK  wire  lines  or  BLACK  power  lines  run  parallel  for  30  meters  or  more, 
increase  the  separation  to  15  centimeters.  (See  paragraph  8.44.  for  more  information.) 

AIO.4.23.  Administrative  Communications  Countermeasures.  Consider  applying  these  countermea¬ 
sures. 

AIO.4.23.1.  BLACK  Intercom  and  Public  Address  Systems.  If  selected,  use  paragraph  A21.2.2. 

(See  paragraph  8.53.  for  more  information.) 

AIO.4.23.2.  Comfort  Music  Systems.  If  selected,  use  paragraph  A21.3.2.  (See  paragraph  8.55.  for 

more  information.) 

AIO.4.23.3.  BLACK  Cable  TV  Systems.  If  selected,  use  paragraph  A21.4.2.  (See  paragraph  8.56. 

for  more  information.)  When  selected: 

AIO.4.23.3.1.  Separate  the  TV  set  from  RED  equipment  by  2  meters. 

AIO.4.23.3.2.  Separate  video  cables  from  RED  equipment,  RED  wire  lines,  RED  power  lines, 
and  RED  signal  ground  wires  by  1  meter. 

AIO.4.23.3.3.  Separate  active  splitters  or  amplifiers  from  RED  equipment,  RED  wire  lines, 
RED  power  lines,  and  RED  signal  ground  wires  by  2  meters. 

AIO.4.23.4.  BLACK  TV-VCR  Systems.  If  selected,  use  paragraph  A21.5.2.  (See  paragraph  8.57. 

for  more  information.)  When  selected: 

AIO.4.23.4. 1 .  Separate  video  cables  from  RED  equipment,  RED  wire  lines,  RED  power  lines, 
and  RED  signal  ground  wires  by  5  meters. 

AIO.4.23.4.2.  Separate  the  BLACK  power  cord  from  RED  equipment,  RED  wire  lines,  RED 
power  lines,  and  RED  signal  ground  wires  by  5  meters. 
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Attachment  11 

FACILITY  ZONE  C,  EQUIPMENT  ZONE  B 

All.l.  Introduction.  This  attachment  addresses  the  following  conditions: 

All.  1.1.  Facilities:  Assigned  Zone  C,  or  more  than  100  meters  of  inspectable  space. 

All.  1.2.  Equipment:  Assigned  Zone  B,  or  the  ERTZ  equal  to  1  to  20  meters,  or  meets  NSTISSAM/ 
TEMPEST  1-92,  Eevel  II  standards. 

AII.2.  Countermeasure  Application. 

A1 1 .2. 1 .  Review  the  need  for  each  required  countermeasure.  Select  it  if  it  is  needed. 

A1 1.2.2.  Review  the  need  for  each  consider  countermeasure.  Do  not  select  it  unless  it  is  needed. 

A1 1.2.3.  Eor  existing  facilities,  when  countermeasures  involving  BEACK  equipment,  BEACK  wire 
lines,  BEACK  power  lines,  and  fortuitous  conductors  cannot  be  met,  the  user  may  request  an  EMSEC 
test  to  determine  if  countermeasures  are  needed. 

AII.3.  Required  Countermeasures.  Select  each  required  countermeasure  unless  the  threat  at  which  the 
countermeasure  is  aimed  does  not  exist.  Explain  why  each  required  countermeasure  not  selected  was  not 
selected.  A  waiver  is  not  needed  for  any  deselected  required  countermeasure  since  the  requirement  for 
protection  has  been  met. 

A1 1 .3. 1 .  Inspectable  Space.  This  countermeasure  is  required.  Specify  the  minimum  inspectable  space 
(distance)  required  to  contain  radiated  compromising  emanations.  (See  paragraphs  8.4.  and  8.5.  for 
more  information.) 

A1 1.3.2.  RED  Equipment  and  BEACK  Equipment  Separation.  This  countermeasure  is  required  if 
BEACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space  unless:  (1)  the  line  distance  of 
the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines  are  fiber  optic;  and,  (2)  BEACK 
power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds 
100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See  paragraph  8.8.  for  more  information.) 

All. 3. 2.1.  Do  not  place  BEACK  equipment  on  the  same  metal  desktop,  metal  bench  surface, 
metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment. 

All. 3. 3.  RED  Equipment  and  BEACK  Wire  Eine  Separation.  This  countermeasure  is  required  if 
BEACK  wire  lines  exit  the  inspectable  space  unless  the  line  distance  of  the  BEACK  wire  lines  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than 
2,000  meters  or  if  the  BEACK  lines  are  fiber  optic.  (See  paragraph  8.9.  for  more  information.) 

A1 1 .3.3. 1 .  Separate  RED  equipment  from  BEACK  wire  lines  by  0.5  meters. 

All. 3. 3. 1.1.  The  separation  distance  is  reduced  to  5  centimeters  if  the  BEACK  wire  lines  are 
shielded,  or. 

All. 3. 3. 1.2.  The  separation  distance  is  reduced  to  15  centimeters  if  a  BEACK  wire  line  isola¬ 
tion  countermeasure  is  used. 
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All. 3. 3. 2.  If  the  user  cannot  achieve  this  separation,  use  a  BLACK  wire  line  isolation  counter¬ 
measure,  filter  BLACK  power  lines,  and  isolate  fortuitous  conductors. 

A1 1.3.4.  RED  Equipment  and  BEACK  Power  Eine  Separation.  This  countermeasure  is  required 
unless:  (1)  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  dis¬ 
tance  of  BEACK  wire  lines  connected  to  BEACK  equipment  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BEACK  lines 
are  fiber  optic.  (See  paragraph  8.10.  for  more  information.) 

All. 3. 4.1.  Separate  RED  equipment  from  BEACK  power  lines  by  0.5  meters. 

All. 3. 4. 1.1.  The  separation  distance  is  reduced  to  5  centimeters  if  the  BEACK  power  lines 
are  shielded. 

All  .3.4. 1.2.  If  the  user  cannot  achieve  this  separation,  use  a  BEACK  wire  line  isolation  coun¬ 
termeasure,  filter  BEACK  power  lines,  and  isolate  fortuitous  conductors. 

All. 3. 5.  RED  Wire  Eine  and  BEACK  Wire  Eine  Separation.  This  countermeasure  is  required  if 
BEACK  wire  lines  exit  the  inspectable  space  unless  the  line  distance  of  the  BEACK  wire  lines  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than 
2,000  meters  or  if  the  BEACK  lines  are  fiber  optic.  (See  paragraph  8.17.  for  more  information.) 

All. 3. 5.1.  Separate  RED  wire  lines  from  BEACK  wire  lines  by  5  centimeters. 

A1 1 .3.5. 1 . 1 .  Do  not  place  RED  and  BEACK  wire  lines  in  a  common  distribution  facility.  It  is 
permitted  to  use  a  common  distribution  facility  for  RED  and  BEACK  fiber  optic  signal  lines 
provided: 

All. 3. 5. 1.1.1.  Either  the  BEACK  or  the  RED  fiber  optic  signal  lines  in  a  RED  distribu¬ 
tion  facility  must  have  an  opaque  sheath.  BEACK  fiber  optic  signal  lines  should  not  have 
metallic  stiffeners  or  sheaths.  If  they  do,  treat  the  stiffeners  or  sheaths  as  fortuitous  conduc¬ 
tors  and  ground  both  ends  of  the  stiffeners  or  sheaths  if  the  BEACK  fiber  optic  signal  lines 
leave  the  inspectable  space. 

All. 3. 5. 1.1. 2.  Separate  RED  fiber  optic  signal  lines  in  BEACK  distribution  facilities 
from  the  distribution  facility  before  the  distribution  facility  exits  the  inspectable  space. 

All. 3. 5. 1.1. 3.  Using  multifiber  bundle  for  both  RED  and  BEACK  signals  is  not  recom¬ 
mended.  If  used,  an  opaque  partition  between  the  RED  and  BEACK  fibers  is  required. 
Maintain  total  accountability  of  all  fibers  to  preclude  compromise  through  misconnection. 

All. 3. 5. 2.  When  RED  and  BEACK  wire  lines  are  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters. 

All .3.6.  Shielded  RED  Wire  Eines.  This  countermeasure  is  required  for  RED  equipment  meeting  the 
requirements  of  NSTISS AM/TEMPEST  1-92,  Eevel  I,  which  must  use  optical  or  shielded  wire  cables 
if  specified  as  part  of  the  manufacturer’s  installation  specification  or  if  specified  for  compliance  with 
TEMPEST  certification.  (See  paragraph  8.23.  for  more  information.) 

A1 1.3.7.  RED  Power.  This  countermeasure  is  required  if  the  facility  contains  BEACK  equipment 
with  signal  wire  lines  that  exit  the  inspectable  space  unless:  (1)  the  line  distance  of  the  BEACK  wire 
lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is 
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greater  than  1,000  meters  or  if  the  BLACK  lines  are  fiber  optic;  or,  a  BLACK  wire  line  isolation  coun¬ 
termeasure  is  used;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a 
point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See 
paragraph  8.27.  for  more  information.) 

A 11. 3. 7.1.  Do  not  power  TEMPEST-certified,  cryptographic  (unless  required  in  technical  manu¬ 
als),  or  BEACK  equipment  from  a  RED  power  circuit. 

A 11. 3. 8.  Administrative  Communications  Countermeasures.  These  countermeasures  are  required. 

A1 1 .3.8. 1 .  BEACK  Telephone  Systems.  Do  not  place  the  telephone  instrument  on  the  same  metal 
desktop,  metal  bench  surface,  metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment.  (See  para¬ 
graph  8.52.  for  more  information.) 

A11.4.  Countermeasures  to  Consider.  Do  not  select  a  consider  countermeasure  unless  the  threat  at 
which  the  countermeasure  is  aimed  does  exist.  Explain  (justify)  why  a  not-required  (consider)  counter¬ 
measure  was  selected. 

A 11. 4.1.  RED  Equipment  and  BEACK  Equipment  Separation.  Consider  applying  this  countermea¬ 
sure  if  BEACK  wire  lines  connected  to  the  BEACK  equipment  exit  the  inspectable  space.  Do  not 
select  this  countermeasure  if:  (1)  the  line  distance  of  the  BEACK  wire  lines  from  the  building  contain¬ 
ing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the 
BEACK  lines  are  fiber  optic;  and,  (2)  BEACK  power  lines  are  contained  within  the  inspectable  space 
up  to  a  point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential 
If  selected,  separate  RED  equipment  from  BEACK  equipment  by  0.5  meters.  If  a  BEACK  wire  line 
isolation  countermeasure  is  used,  the  separation  distance  is  reduced  to  15  centimeters.  (See  paragraph 
8.8.  for  more  information.) 

All .4.2.  RED  Wire  Eine  and  BEACK  Equipment  Separation.  Consider  applying  this  countermeasure 
if  BEACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space.  Do  not  select  this  counter¬ 
measure  if  the  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines  are 
fiber  optic.  If  selected,  separate  RED  wire  lines  from  BEACK  equipment  by  0.5  meters.  If  a  BEACK 
wire  line  isolation  countermeasure  is  used,  the  separation  distance  is  reduced  to  15  centimeters.  (See 
paragraph  8.16.  for  more  information.) 

A1 1.4.3.  RED  Wire  Eine  and  BEACK  Power  Eine  Separation.  Consider  applying  this  countermea¬ 
sure.  Do  not  select  this  countermeasure  if:  (1)  BEACK  power  lines  are  contained  within  the  inspect¬ 
able  space  up  to  a  point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000 
volts  potential;  and,  (2)  the  line  distance  of  the  BEACK  wire  line  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BEACK 
lines  are  fiber  optic.  If  selected,  separate  RED  wire  lines  from  BEACK  power  lines  by  5  centimeters. 
If  selected,  when  RED  wire  lines  and  BEACK  power  lines  are  run  parallel  for  30  meters  or  more, 
increase  the  separation  to  15  centimeters.  (See  paragraph  8.18.  for  more  information.) 

A 11. 4. 4.  RED  Wire  Eine  and  BEACK  Signal  Ground  Wire  Separation.  Consider  applying  this  coun¬ 
termeasure  if  BEACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if  the  line  distance 
of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  the  BEACK  lines  are  fiber  optic.  If  selected,  separate 
RED  wire  lines  from  BEACK  signal  ground  wires  by  5  centimeters.  When  RED  wire  lines  run  paral- 
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lei  to  BLACK  signal  ground  wires  for  30  meters  or  more,  increase  the  separation  to  15  centimeters. 
(See  paragraph  8.19.  for  more  information.) 

A1 1.4.5.  RED  Wire  Line  and  Fortuitous  Conductor  Separation.  Consider  applying  this  countermea¬ 
sure  if  fortuitous  conductors  exit  the  inspectable  space.  Do  not  select  this  countermeasure  if:  (1)  the 
line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  bound¬ 
ary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines  are  fiber  optic;  or  (2) 
BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  RED  wire  lines 
from  fortuitous  conductors  by  5  centimeters.  When  RED  wire  lines  run  parallel  to  a  fortuitous  conduc¬ 
tor  for  30  meters  or  more  and  the  same  fortuitous  conductor  runs  parallel  to  BLACK  wire  lines  or 
BLACK  power  lines  for  30  meters  or  more,  increase  separation  to  15  centimeters.  (See  paragraph 
8.20.  for  more  information.) 

A1 1.4.6.  Filtered  RED  Power.  Consider  applying  this  countermeasure  if  RED  power  is  required.  Do 
not  select  this  countermeasure  if  the  power  lines  feeding  the  RED  power  circuit  are  contained  within 
the  inspectable  space  up  to  a  point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least 
10,000  volts  potential.  (See  paragraph  8.28.  for  more  information.) 

All. 4. 6.1.  If  selected,  do  not  power  TEMPEST-certified,  cryptographic  (unless  required  in  tech¬ 
nical  manuals),  or  BLACK  equipment  from  a  filtered  RED  power  circuit. 

A  11.4.7.  RED  Power  Line  and  BLACK  Equipment  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  selected  and  BLACK  equipment  has  signal  wire  lines  that  exit  the  inspectable 
space.  Do  not  select  this  countermeasure  if:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the 
building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000 
meters,  the  BLACK  lines  are  fiber  optic,  or  a  BLACK  line  isolation  countermeasure  is  used;  and,  (2) 
BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  RED  power 
lines  from  BLACK  equipment  by  0.5  meters.  If  a  BLACK  wire  line  isolation  countermeasure  is  used, 
the  separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.29.  for  more  information.) 

A  11.4.8.  RED  Power  Line  and  BLACK  Wire  Line  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  selected  and  BLACK  wire  lines  exit  the  inspectable  space.  Do  not  select  this 
countermeasure  if  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BLACK  lines 
are  fiber  optic.  If  selected,  separate  RED  power  lines  from  BLACK  wire  lines  by  5  centimeters.  When 
RED  power  lines  and  BLACK  signal  ground  wires  are  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.30.  for  more  information.) 

A1 1.4.9.  RED  Power  Line  and  BLACK  Power  Line  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  selected.  Do  not  select  this  countermeasure  if:  (1)  BLACK  power  lines  are  con¬ 
tained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds  100,000 
volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the  BLACK  wire  lines 
from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  1,000  meters  or  if  the  BLACK  lines  are  fiber  optic.  If  selected,  separate  RED  power  lines  from 
BLACK  power  lines  by  5  centimeters.  When  RED  power  lines  and  BLACK  power  lines  are  run  par¬ 
allel  for  30  meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph  8.31.  for  more 
information.) 
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All. 4. 10.  RED  Power  Line  and  BLACK  Signal  Ground  Wire  Separation.  Consider  applying  this 
countermeasure  if  RED  power  and  BLACK  signal  ground  countermeasures  are  selected.  Do  not  select 
this  countermeasure  if:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK 
lines  are  fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a 
point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If 
selected,  separate  RED  power  lines  from  BLACK  signal  ground  wires  by  5  centimeters.  When  RED 
power  lines  and  BLACK  signal  ground  wires  are  run  parallel  for  30  meters  or  more,  increase  the  sep¬ 
aration  to  15  centimeters.  (See  paragraph  8.32.  for  more  information.) 

All. 4. 11.  RED  Power  Line  and  Lortuitous  Conductor  Separation.  Consider  applying  this  counter¬ 
measure  if  RED  power  is  selected  and  fortuitous  conductors  exit  the  inspectable  space.  Do  not  select 
this  countermeasure  if:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines 
are  fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  power  lines  from  fortuitous  conductors  by  5  centimeters.  When  RED  power  lines  run 
parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortuitous  conductor  and 
BLACK  wire  lines  or  BLACK  power  lines  run  parallel  for  30  meters  or  more,  increase  the  separation 
to  15  centimeters.  (See  paragraph  8.33.  for  more  information.) 

All. 4. 12.  RED  Signal  Ground.  Consider  applying  this  countermeasure  if  RED  equipment  needs  a 
signal  ground,  RED  power  filters  are  installed,  cryptographic  equipment  is  installed  in  facility,  or 
RED  wire  lines  are  shielded.  Do  not  select  this  countermeasure  if  the  facility  is  completely  contained 
within  the  inspectable  space.  (See  paragraph  8.35.  for  more  information.) 

A1 1 .4. 13.  BLACK  Signal  Ground.  Consider  applying  this  countermeasure  if  BLACK  wire  line  filters 
or  cryptographic  equipment  is  installed  in  the  facility  or  BLACK  wire  lines  are  shielded.  (See  para¬ 
graph  8.35.  for  more  information.) 

A 11. 4. 13.1.  Do  not  select  this  countermeasure  if  the  facility  is  completely  contained  within  the 

inspectable  space. 

A 11. 4. 13. 2.  Do  not  use  BLACK  signal  ground  as  the  signal  ground  for  BLACK  equipment; 

BLACK  signal  ground  carries  compromising  emanations. 

All. 4. 14.  RED  Signal  Ground  Wire  and  BLACK  Equipment  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected  and  BLACK  equipment  has  signal  wire  lines 
which  exit  the  inspectable  space.  Do  not  select  this  countermeasure  if:  (1)  the  line  distance  of  the 
BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspect¬ 
able  space  is  greater  than  1,000  meters  or  if  the  BLACK  lines  are  fiber  optic;  and,  (2)  BLACK  power 
lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds  100,000 
volt-amperes  and  at  least  10,000  volts  potential.  Do  not  select  this  countermeasure  if  the  facility  is 
completely  contained  within  the  inspectable  space.  If  selected,  separate  RED  signal  ground  wires 
from  BLACK  equipment  by  0.5  meters.  If  a  BLACK  wire  line  isolation  countermeasure  is  used,  the 
separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.36.  for  more  information.) 

All. 4. 15.  RED  Signal  Ground  Wire  and  BLACK  Wire  Line  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected  and  BLACK  wire  lines  exit  the  inspectable  space. 
Do  not  select  this  countermeasure  if  the  line  distance  of  the  BLACK  wire  lines  from  the  building  con- 
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taining  the  RED  equipment  to  the  boundary  of  the  inspectable  spaee  is  greater  than  2,000  meters  or  if 
the  BLACK  lines  are  fiber  optic.  If  selected,  separate  RED  signal  ground  wires  from  BLACK  wire 
lines  by  5  centimeters.  When  RED  signal  ground  wires  run  parallel  to  BLACK  wire  lines  for  30 
meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph  8.37.  for  more  information.) 

All. 4. 16.  RED  Signal  Ground  Wire  and  BLACK  Power  Line  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1)  BLACK 
power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds 
100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the  BLACK  wire 
lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is 
greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  If  selected,  separate  RED  signal  ground 
wires  from  BLACK  power  lines  by  5  centimeters.  When  RED  signal  ground  wires  run  parallel  to 
BLACK  power  lines  for  30  meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph 
8.38.  for  more  information.) 

A1 1 .4. 17.  RED  Signal  Ground  Wire  and  BLACK  Signal  Ground  Wire  Separation.  Consider  applying 
this  countermeasure  if  RED  and  BLACK  signal  grounds  are  selected.  Do  not  select  this  countermea¬ 
sures  if:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are 
fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  signal  ground  wires  from  BLACK  signal  ground  wires  by  5  centimeters.  When  RED 
signal  ground  wires  run  parallel  to  BLACK  signal  ground  wires  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.39.  for  more  information.) 

All. 4. 18.  RED  Signal  Ground  Wire  and  Lortuitous  Conductor  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected  and  fortuitous  conductors  exit  the  inspectable 
space.  Do  not  select  this  countermeasure  if:  (1)  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines 
are  fiber  optic;  or,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  signal  ground  wires  from  fortuitous  conductors  by  5  centimeters.  When  RED  signal 
ground  wires  run  parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortuitous  con¬ 
ductor  and  BLACK  wire  lines  or  BLACK  power  lines  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.40.  for  more  information.) 

All.4.19.  BLACK  Signal  Ground  Wire  and  BLACK  Equipment  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1)  the  line 
distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary 
of  the  inspectable  space  is  more  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic;  and,  (2) 
BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  BLACK  signal 
ground  wires  from  BLACK  equipment  by  5  centimeters.  (See  paragraph  8.41.  for  more  information.) 

A  11.4.20.  BLACK  Signal  Ground  Wire  and  BLACK  Wire  Line  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if  the  line  dis¬ 
tance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of 
the  inspectable  space  is  greater  than  2,000  meters  or  if  the  BLACK  lines  are  fiber  optic.  If  selected, 
separate  BLACK  signal  ground  wires  from  BLACK  wire  lines  by  5  centimeters.  When  a  BLACK  sig- 
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nal  ground  wire  runs  parallel  to  a  BLACK  wire  line  for  30  meters  or  more,  increase  the  separation  to 
15  centimeters.  (See  paragraph  8.42.  for  more  information.) 

All. 4. 21.  BLACK  Signal  Ground  Wire  and  BLACK  Power  Line  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1) 
BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt- amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the 
BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspect¬ 
able  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  If  selected,  separate 
BLACK  signal  ground  wires  from  BLACK  power  lines  by  5  centimeters.  When  a  BLACK  signal 
ground  wire  runs  parallel  to  a  BLACK  power  line  for  30  meters  or  more,  increase  the  separation  to  15 
centimeters.  (See  paragraph  8.43.  for  more  information.) 

All .4.22.  BLACK  Signal  Ground  Wire  and  Fortuitous  Conductor  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected  and  fortuitous  conductors  exit  the  inspectable 
space.  Do  not  select  this  countermeasure  if:  (1)  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BEACK  lines 
are  fiber  optic;  or,  (2)  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  BEACK  signal  ground  wires  from  fortuitous  conductors  by  5  centimeters.  When  BEACK 
signal  ground  wires  run  parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortu¬ 
itous  conductor  and  BEACK  wire  lines  or  BEACK  power  lines  run  parallel  for  30  meters  or  more, 
increase  the  separation  to  15  centimeters.  (See  paragraph  8.44.  for  more  information.) 
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Attachment  12 

FACILITY  ZONE  A,  EQUIPMENT  ZONE  C 

A12.1.  Introduction.  This  attachment  addresses  the  following  conditions: 

A12.1.1.  Facilities:  Assigned  Zone  A,  or  less  than  20  meters  of  inspectable  space. 

A12.1.2.  Equipment:  Assigned  Zone  C,  or  the  ERTZ  more  than  20  meters  but  less  than  100  meters,  or 
meets  NSTISSAM/TEMPEST  1-92,  Eevel  III  standards,  or  all  other  RED  equipment. 

NOTE:  This  installation  may  cause  serious  TEMPEST  hazards.  If  the  facility  is  TEMPEST-zoned  and 
using  TEMPEST-zoned  equipment,  contact  the  CTTA  to  evaluate  the  actual  TEMPEST  zone  test  results 
for  the  equipment  and  the  facility  to  determine  if  using  the  equipment  in  the  facility  is  possible. 

AI2.2.  Countermeasure  Application. 

A12.2.1.  Review  the  need  for  each  required  countermeasure.  Select  it  if  it  is  needed. 

A12.2.2.  Review  the  need  for  each  consider  countermeasure.  Do  not  select  it  unless  it  is  needed. 

A12.2.3.  Eor  existing  facilities,  when  countermeasures  involving  BEACK  equipment,  BEACK  wire 
lines,  BEACK  power  lines,  and  fortuitous  conductors  cannot  be  met,  the  user  may  request  an  EMSEC 
test  to  determine  if  countermeasures  are  needed. 

AI2.3.  Required  Countermeasures.  Select  each  required  countermeasure  unless  the  threat  at  which  the 
countermeasure  is  aimed  does  not  exist.  Explain  why  each  required  countermeasure  not  selected  was  not 
selected.  A  waiver  is  not  needed  for  any  deselected  required  countermeasure  since  the  requirement  for 
protection  has  been  met. 

A12.3.1.  Inspectable  Space.  This  countermeasure  is  required.  Specify  the  minimum  inspectable 
space  (distance)  required  to  contain  radiated  compromising  emanations.  (See  paragraphs  8.4.  and  8.5. 
for  more  information.) 

A1 2.3.2.  RED  Equipment  and  BEACK  Equipment  Separation.  This  countermeasure  is  required  if 
BEACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space  unless:  (1)  the  line  distance  of 
the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines  are  fiber  optic;  and,  (2)  BEACK 
power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds 
100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See  paragraph  8.8.  for  more  information.) 

A12.3.2.1.  Separate  RED  equipment  from  BEACK  equipment  by  1  meter. 

A12.3.2.1.1.  The  separation  distance  is  reduced  to  15  centimeters  if  a  BEACK  wire  line  isola¬ 
tion  countermeasure  is  used. 

A12.3.2.1.2.  If  the  user  cannot  achieve  this  separation,  use  a  BEACK  wire  line  isolation  coun¬ 
termeasure,  filter  BEACK  power  lines,  and  isolate  fortuitous  conductors. 

A12.3.2.2.  Do  not  place  BEACK  equipment  on  the  same  metal  desktop,  metal  bench  surface, 
metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment. 

A 12. 3. 3.  RED  Equipment  and  BEACK  Wire  Eine  Separation.  This  countermeasure  is  required  for 
BEACK  wire  lines  that  exit  the  inspectable  space  unless  the  line  distance  of  the  BEACK  wire  lines 
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from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  2,000  meters  or  if  the  BLACK  lines  are  fiber  optic.  (See  paragraph  8.9.  for  more  information.) 

A12.3.3.1.  Separate  RED  equipment  from  BLACK  wire  lines  by  1  meter. 

A12.3.3.1.1.  The  separation  distance  is  reduced  to  5  centimeters  if  the  BLACK  wire  lines  are 
shielded,  or, 

A12.3.3.1.2.  The  separation  distance  is  reduced  to  15  centimeters  if  a  BLACK  wire  line  isola¬ 
tion  countermeasure  is  used. 

A12.3.3.2.  If  the  user  cannot  achieve  this  separation,  use  a  BLACK  wire  line  isolation  counter¬ 
measure,  filter  BLACK  power  lines,  and  isolate  fortuitous  conductors. 

A12.3.4.  RED  Equipment  and  BLACK  Power  Line  Separation.  This  countermeasure  is  required 
unless:  (1)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  dis¬ 
tance  of  BLACK  wire  lines  connected  to  BLACK  equipment  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines 
are  fiber  optic.  (See  paragraph  8.10.  for  more  information.) 

A 12. 3. 4.1.  Separate  RED  equipment  from  BLACK  power  lines  by  1  meter. 

A12.3.4.1.1.  The  separation  distance  is  reduced  to  5  centimeters  if  the  BLACK  power  lines 
are  shielded. 

A12.3.4.1.2.  If  the  user  cannot  achieve  this  separation,  use  a  BLACK  wire  line  isolation  coun¬ 
termeasure,  filter  BLACK  power  lines,  and  isolate  fortuitous  conductors. 

A12.3.5.  RED  Equipment  and  Lortuitous  Conductor  Separation.  This  countermeasure  is  required  for 
fortuitous  conductors  that  exit  the  inspectable  space,  BLACK  wires  that  exit  the  inspectable  space, 
and  BLACK  power  lines  unless:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the  building  con¬ 
taining  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  250  meters  or  the 
BLACK  lines  are  fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space 
up  to  a  point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 
(See  paragraph  8.12.  for  more  information.) 

A12.3.5.1.  Separate  RED  equipment  from  fortuitous  conductors  by  1  meter. 

A12.3.5. 1 . 1 .  If  the  user  cannot  achieve  this  separation,  use  a  BLACK  wire  line  isolation  coun¬ 
termeasure,  filter  BLACK  power  lines,  and  isolate  fortuitous  conductors. 

A12.3.6.  RED  Wire  Line  and  BLACK  Wire  Line  Separation.  This  countermeasure  is  required  if 
BLACK  wire  lines  exit  the  inspectable  space  unless  the  line  distance  of  the  BLACK  wire  lines  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than 
2,000  meters  or  if  the  BLACK  lines  are  fiber  optic.  (See  paragraph  8.17.  for  more  information.) 

A12.3.6.1.  Separate  RED  wire  lines  from  BLACK  wire  lines  by  5  centimeters. 

A12.3.6.1.1.  Do  not  place  RED  and  BLACK  wire  lines  in  a  common  distribution  facility.  It  is 
permitted  to  use  a  common  distribution  facility  for  RED  and  BLACK  fiber  optic  signal  lines 
provided: 

A12.3.6.1.1.1.  Either  the  BLACK  or  the  RED  fiber  optic  signal  lines  in  a  RED  distribu¬ 
tion  facility  must  have  an  opaque  sheath.  BLACK  fiber  optic  signal  lines  should  not  have 
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metallic  stiffeners  or  sheaths.  If  they  do,  treat  the  stiffeners  or  sheaths  as  fortuitous  conduc¬ 
tors  and  ground  both  ends  of  the  stiffeners  or  sheaths  if  the  BLACK  fiber  optic  signal  lines 
leave  the  inspectable  space. 

A12.3.6.1.1.2.  Separate  RED  fiber  optic  signal  lines  in  BLACK  distribution  facilities 
from  the  distribution  facility  before  the  distribution  facility  exits  the  CAA. 

A12.3.6.1.1.3.  Using  multifiber  bundle  for  both  RED  and  BLACK  signals  is  not  recom¬ 
mended.  If  used,  an  opaque  partition  between  the  RED  and  BLACK  fibers  is  required. 
Maintain  total  accountability  of  all  fibers  to  preclude  compromise  through  misconnection. 

A12.3.6.2.  When  RED  and  BLACK  wire  lines  are  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters. 

A12.3.7.  RED  Wire  Line  and  BLACK  Power  Line  Separation.  This  countermeasure  is  required 
unless:  (1)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt- amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  dis¬ 
tance  of  the  BLACK  wire  line  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  (See  paragraph 
8.18.  for  more  information.) 

A12.3.7.1.  Separate  RED  wire  lines  from  BLACK  power  lines  by  5  centimeters. 

A 12. 3. 7. 2.  When  RED  wire  lines  and  BLACK  power  lines  are  run  parallel  for  30  meters  or  more, 
increase  the  separation  to  15  centimeters. 

A12.3.8.  Shielded  RED  Wire  Lines.  This  countermeasure  is  required.  (See  paragraph  8.23.  for  more 
information.) 

A12.3.8.1.  Lor  TEMPEST-Certified  Equipment.  RED  equipment  meeting  the  requirements  of 
NSTISS AM/TEMPEST  1-92,  Level  I  must  use  optical  or  shielded  wire  cables  if  specified  as  part 
of  the  manufacturer’s  installation  specification  or  if  specified  for  compliance  with  TEMPEST  cer¬ 
tification. 

A12.3.8.2.  Eor  Non-TEMPEST-Certified  Equipment.  Shield  and  insulate  RED  wire  lines  even 
when  all  separation  distances  for  RED  equipment,  RED  wire  lines,  RED  power  lines,  RED  signal 
ground  wires,  and  BLACK  signal  ground  wires  from  BLACK  equipment,  BLACK  wire  lines, 
BLACK  power  lines,  and  fortuitous  conductors  that  exit  the  inspectable  space  are  met.  Attach¬ 
ment  18  contains  specifications  for  shielded  cables. 

A12.3.9.  RED  Power.  This  countermeasure  is  required  if  the  facility  contains  BLACK  equipment 
with  signal  wire  lines  that  exit  the  inspectable  space  unless:  (1)  the  line  distance  of  the  BLACK  wire 
lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is 
greater  than  1,000  meters  or  if  the  BLACK  lines  are  fiber  optic,  or  a  BLACK  wire  line  isolation  coun¬ 
termeasure  is  used;  and  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a 
point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See 
paragraph  8.27.  for  more  information.) 

A12.3.9.1.  Do  not  power  TEMPEST-certified,  cryptographic  (unless  required  in  technical  manu¬ 
als),  or  BLACK  equipment  from  a  RED  power  circuit. 

A12.3.10.  Entered  RED  Power.  This  countermeasure  is  required  unless  the  power  lines  feeding  the 
facility  containing  the  RED  equipment  are  contained  within  the  inspectable  space  up  to  a  point  where 


AFMAN33-214V2  21  SEPTMEBER  2001 


143 


the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See  paragraph 
8.28.  for  more  information.) 

A12.3.10.1.  Do  not  power  TEMPEST-certified,  cryptographic  (unless  required  in  technical  man¬ 
uals),  or  BEACK  equipment  from  a  filtered  RED  power  circuit. 

A12.3.11.  Administrative  Communications  Countermeasures.  These  countermeasures  are  required. 

A12.3.11.1.  BEACK  Telephone  Systems.  Do  not  place  the  telephone  instrument  on  the  same 
metal  desktop,  metal  bench  surface,  metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment.  (See 
paragraph  8.52.  for  more  information.) 

A12.3.11.2.  BEACK  Intercom  and  Public  Address  Systems.  Use  paragraph  A12.2.1.  (See  para¬ 
graph  8.53.  for  more  information.) 

A 12. 3. 11. 3.  BEACK  EANs.  (See  paragraph  8.54.  for  more  information.) 

A12.3.11.3.1.  Separate  RED  equipment  from  EAN  equipment  and  signal  wire  lines  as 
required  for  RED  equipment  and  BEACK  equipment  separation  and  RED  equipment  and 
BEACK  wire  line  separation  in  this  attachment. 

A12. 3. 11.3.2.  Separate  RED  wire  lines  from  EAN  signal  wire  lines  as  required  for  RED  wire 
line  and  BEACK  wire  line  separation  in  this  attachment. 

A12.3.11.4.  Comfort  Music  Systems.  Use  paragraph  A12.3.1.  (See  paragraph  8.55.  for  more 
information.) 

A12.3.11.5.  BEACK  Cable  TV  Systems.  Use  paragraph  A12.4.1.  (See  paragraph  8.56.  for  more 
information.) 

A12. 3. 11.5.1.  Separate  the  TV  set  from  RED  equipment  by  3  meters. 

A12. 3. 11.5.2.  Separate  video  cables  from  RED  equipment,  RED  wire  lines,  RED  power  lines, 
and  RED  signal  ground  wires  by  2  meters. 

A12.3.11.5.3.  Separate  active  splitters  or  amplifiers  from  RED  equipment,  RED  wire  lines, 
RED  power  lines,  and  RED  signal  ground  wires  by  2  meters. 

A12.3.11.6.  BEACK  TV-VCR  Systems.  Use  paragraph  A12.5.1.  Separate  the  BEACK  power 
cord  from  RED  equipment,  RED  wire  lines,  RED  power  lines,  and  RED  signal  ground  wires  by  5 
meters.  (See  paragraph  8.57.  for  more  information.) 

A12.3.12.  Timing  and  Control  Eines.  This  countermeasure  is  required.  Eollow  the  guidance  in  para¬ 
graph  8.59. 

A12.3.13.  Utility  Control  Cables.  This  countermeasure  is  required.  Eollow  the  guidance  in  paragraph 

8.60. 


A12.4.  Countermeasures  to  Consider.  Do  not  select  a  consider  countermeasure  unless  the  threat  at 
which  the  countermeasure  is  aimed  does  exist.  Explain  (justify)  why  a  not-required  (consider)  counter¬ 
measure  was  selected. 

NOTE:  When  making  the  countermeasures  review,  be  more  conscientious  in  requiring  the  “consider” 
countermeasures  in  paragraphs  A12.4.1.  through  A12.4.21.  if  the  inspectable  space  is  less  than  8  meters. 
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A12.4.1.  RED  Equipment  and  BEACK  Signal  Ground  Wire  Separation.  Consider  applying  this  coun¬ 
termeasure  if  BEACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if  the  line  distance 
of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  the  BEACK  lines  are  fiber  optic.  If  selected,  separate 
RED  equipment  from  BEACK  signal  ground  wires  by  1  meter.  If  selected,  separate  RED  equipment 
from  BEACK  signal  ground  wires  by  1  meter.  If  a  BEACK  wire  line  isolation  countermeasure  is  used, 
the  separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.11.  for  more  information.) 

A12.4.2.  RED  Wire  Eine  and  BEACK  Equipment  Separation.  Consider  applying  this  countermea¬ 
sure  if  BEACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space.  Do  not  select  this 
countermeasure  if  the  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines 
are  fiber  optic.  If  selected,  separate  RED  wire  lines  from  BEACK  equipment  by  1  meter.  If  a  BEACK 
wire  line  isolation  countermeasure  is  used,  the  separation  distance  is  reduced  to  15  centimeters.  (See 
paragraph  8.16.  for  more  information.) 

A12.4.3.  RED  Wire  Eine  and  BEACK  Signal  Ground  Wire  Separation.  Consider  applying  this  coun¬ 
termeasure  if  BEACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if  the  line  distance 
of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  the  BEACK  lines  are  fiber  optic.  If  selected,  separate 
RED  wire  lines  from  BEACK  signal  ground  wires  by  5  centimeters.  When  RED  wire  lines  run  paral¬ 
lel  to  BEACK  signal  ground  wires  for  30  meters  or  more,  increase  the  separation  to  15  centimeters. 
(See  paragraph  8.19.  for  more  information.) 

A12.4.4.  RED  Wire  Eine  and  Eortuitous  Conductor  Separation.  Consider  applying  this  countermea¬ 
sure  if  fortuitous  conductors  exit  the  inspectable  space.  Do  not  select  this  countermeasure  if:  (1)  the 
line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  bound¬ 
ary  of  the  inspectable  space  is  more  than  250  meters  or  the  BEACK  lines  are  fiber  optic;  or  (2) 
BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  RED  wire  lines 
from  fortuitous  conductors  by  5  centimeters.  When  RED  wire  lines  run  parallel  to  a  fortuitous  conduc¬ 
tor  for  30  meters  or  more  and  the  same  fortuitous  conductor  runs  parallel  to  BEACK  wire  lines  or 
BEACK  power  lines  for  30  meters  or  more,  increase  separation  to  15  centimeters.  (See  paragraph 
8.20.  for  more  information.) 

A12.4.5.  Shielded  BEACK  Wire  Eines.  Consider  applying  this  countermeasure  when  BEACK  wire 
lines  are  not  separated  by  the  required  distance  from  RED  equipment,  RED  wire  lines,  RED  power 
lines,  RED  signal  ground  wires,  BEACK  signal  ground  wires,  or  fortuitous  conductors.  (1)  Do  not 
select  this  countermeasure  if  the  required  separation  distance  for  RED  equipment,  RED  power  lines, 
RED  signal  ground  wires,  BEACK  signal  ground  wires,  or  fortuitous  conductors  from  BEACK  wire 
lines  is  not  met,  but,  the  line  distance  of  the  BEACK  wire  lines  connected  to  BEACK  equipment  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than 
1,000  meters  or  the  BEACK  lines  are  fiber  optic.  (2)  Do  not  select  this  countermeasure  if  the  required 
separation  distance  for  RED  wire  lines  from  BEACK  wire  lines  is  not  met,  but,  the  line  distance  of  the 
BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspect¬ 
able  space  is  greater  than  2,000  meters  or  the  BEACK  lines  are  fiber  optic.  Attachment  18  contains 
specifications  for  shielded  cables.  (See  paragraph  8.24.  for  more  information.) 
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A12.4.5.1.  If  the  selection  of  this  countermeasure  concerns  fortuitous  conductors,  do  not  apply  it 
unless  RED  wire  lines,  RED  signal  ground  wires,  or  BEACK  signal  ground  wires  run  parallel 
within  5  centimeters  of  a  fortuitous  conductor  for  30  meters  or  more,  and,  BEACK  wire  lines  also 
run  parallel  within  5  centimeters  of  the  same  fortuitous  conductor  for  30  meters  or  more. 

A12.4.5.2.  This  countermeasure  is  not  needed  if  there  is  at  least  1  meter  separation  between  a  par¬ 
allel  RED  wire  line  and  a  BEACK  wire  line  or  a  common  fortuitous  conductor  run. 

A12.4.6.  RED  Power  Eine  and  BEACK  Equipment  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  selected  and  BEACK  equipment  has  signal  wire  lines  that  exit  the  inspectable 
space.  Do  not  select  this  countermeasure  if:  (1)  the  line  distance  of  the  BEACK  wire  lines  from  the 
building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000 
meters,  the  BEACK  lines  are  fiber  optic,  or  a  BEACK  line  isolation  countermeasure  is  used;  and,  (2) 
BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  RED  power 
lines  from  BEACK  equipment  by  1  meter.  If  a  BEACK  wire  line  isolation  countermeasure  is  used,  the 
separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.29.  for  more  information.) 

A12.4.7.  RED  Power  Eine  and  BEACK  Wire  Eine  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  selected  and  BEACK  wire  lines  exit  the  inspectable  space.  Do  not  select  this 
countermeasure  if  the  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines 
are  fiber  optic.  If  selected,  separate  RED  power  lines  from  BEACK  wire  lines  by  5  centimeters.  When 
RED  power  lines  and  BEACK  signal  ground  wires  are  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.30.  for  more  information.) 

A12.4.8.  RED  Power  Eine  and  BEACK  Power  Eine  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  selected.  Do  not  select  this  countermeasure  if:  (1)  BEACK  power  lines  are  con¬ 
tained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds  100,000 
volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the  BEACK  wire  lines 
from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  1,000  meters  or  if  the  BEACK  lines  are  fiber  optic.  If  selected,  separate  RED  power  lines  from 
BEACK  power  lines  by  5  centimeters.  When  RED  power  lines  and  BEACK  power  lines  are  run  par¬ 
allel  for  30  meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph  8.31.  for  more 
information.) 

A  12.4.9.  RED  Power  Eine  and  BEACK  Signal  Ground  Wire  Separation.  Consider  applying  this 
countermeasure  if  the  RED  power  and  BEACK  signal  ground  countermeasures  are  selected.  Do  not 
select  this  countermeasure  if:  (1)  the  line  distance  of  the  BEACK  wire  lines  from  the  building  contain¬ 
ing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the 
BEACK  lines  are  fiber  optic;  and,  (2)  BEACK  power  lines  are  contained  within  the  inspectable  space 
up  to  a  point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 
If  selected,  separate  RED  power  lines  from  BEACK  signal  ground  wires  by  5  centimeters.  When  RED 
power  lines  and  BEACK  signal  ground  wires  are  run  parallel  for  30  meters  or  more,  increase  the  sep¬ 
aration  to  15  centimeters.  (See  paragraph  8.32.  for  more  information.) 

A12.4.10.  RED  Power  Eine  and  Eortuitous  Conductor  Separation.  Consider  applying  this  counter¬ 
measure  if  RED  power  is  selected  and  fortuitous  conductors  exit  the  inspectable  space.  Do  not  select 
this  countermeasure  if:  (1)  the  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the 
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RED  equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines 
are  fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  power  lines  from  fortuitous  conductors  by  5  centimeters.  When  RED  power  lines  run 
parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortuitous  conductor  and 
BLACK  wire  lines  or  BLACK  power  lines  run  parallel  for  30  meters  or  more,  increase  the  separation 
to  15  centimeters.  (See  paragraph  8.33.  for  more  information.) 

A12.4.11.  RED  Signal  Ground.  Consider  applying  this  countermeasure  if  RED  equipment  needs  a 
signal  ground,  RED  power  filters  or  cryptographic  equipment  are  installed  in  the  facility,  or  RED  wire 
lines  are  shielded.  Do  not  select  this  countermeasure  if  the  facility  is  completely  contained  within  the 
inspectable  space.  (See  paragraph  8.35.  for  more  information.) 

A12.4.12.  BLACK  Signal  Ground.  Consider  applying  this  countermeasure  if  BLACK  wire  line  fil¬ 
ters  or  cryptographic  equipment  are  installed  in  the  facility  or  BLACK  wire  lines  are  shielded.  (See 
paragraph  8.35.  for  more  information.) 

A12.4.12.1.  Do  not  select  this  countermeasure  if  the  facility  is  completely  contained  within  the 

inspectable  space. 

A12.4.12.2.  Do  not  use  BLACK  signal  ground  as  the  signal  ground  for  BLACK  equipment; 

BLACK  signal  ground  carries  compromising  emanations. 

A12.4.13.  RED  Signal  Ground  Wire  and  BLACK  Equipment  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected  and  BLACK  equipment  has  signal  wire  lines 
which  exit  the  inspectable  space.  Do  not  select  this  countermeasure  if:  (1)  the  line  distance  of  the 
BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspect¬ 
able  space  is  greater  than  1,000  meters  or  if  the  BLACK  lines  are  fiber  optic;  and,  (2)  BLACK  power 
lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds  100,000 
volt-amperes  and  at  least  10,000  volts  potential.  Do  not  select  this  countermeasure  if  the  facility  is 
completely  contained  within  the  inspectable  space.  If  selected,  separate  RED  signal  ground  wires 
from  BLACK  equipment  by  1  meter.  If  a  BLACK  wire  line  isolation  countermeasure  is  used,  the  sep¬ 
aration  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.36.  for  more  information.) 

A12.4.14.  RED  Signal  Ground  Wire  and  BLACK  Wire  Line  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected  and  BLACK  wire  lines  exit  the  inspectable  space. 
Do  not  select  this  countermeasure  if  the  line  distance  of  the  BLACK  wire  lines  from  the  building  con¬ 
taining  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  2,000  meters  or  if 
the  BLACK  lines  are  fiber  optic.  If  selected,  separate  RED  signal  ground  wires  from  BLACK  wire 
lines  by  5  centimeters.  When  RED  signal  ground  wires  run  parallel  to  BLACK  wire  lines  for  30 
meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph  8.37.  for  more  information.) 

A12.4.15.  RED  Signal  Ground  Wire  and  BLACK  Power  Line  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1)  BLACK 
power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds 
100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the  BLACK  wire 
lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is 
greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  If  selected,  separate  RED  signal  ground 
wires  from  BLACK  power  lines  by  5  centimeters.  When  RED  signal  ground  wires  run  parallel  to 
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BLACK  power  lines  for  30  meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph 
8.38.  for  more  information.) 

A12.4. 16.  RED  Signal  Ground  Wire  and  BLACK  Signal  Ground  Wire  Separation.  Consider  applying 
this  countermeasure  if  RED  and  BLACK  signal  grounds  are  selected.  Do  not  select  this  countermea¬ 
sures  if:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are 
fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  signal  ground  wires  from  BLACK  signal  ground  wires  by  5  centimeters.  When  RED 
signal  ground  wires  run  parallel  to  BLACK  signal  ground  wires  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.39.  for  more  information.) 

A12.4.17.  RED  Signal  Ground  Wire  and  Lortuitous  Conductor  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected  and  fortuitous  conductors  exit  the  inspectable 
space.  Do  not  select  this  countermeasure  if:  (1)  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines 
are  fiber  optic;  or,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  signal  ground  wires  from  fortuitous  conductors  by  5  centimeters.  When  RED  signal 
ground  wires  run  parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortuitous  con¬ 
ductor  and  BLACK  wire  lines  or  BLACK  power  lines  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.40.  for  more  information.) 

A12.4.18.  BLACK  Signal  Ground  Wire  and  BLACK  Equipment  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1)  the  line 
distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary 
of  the  inspectable  space  is  more  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic;  and,  (2) 
BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  BLACK  signal 
ground  wires  from  BLACK  equipment  by  1  meter.  If  a  BLACK  wire  line  isolation  countermeasure  is 
used,  the  separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.41.  for  more  information.) 

A12.4.19.  BLACK  Signal  Ground  Wire  and  BLACK  Wire  Line  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if  the  line  dis¬ 
tance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of 
the  inspectable  space  is  greater  than  2,000  meters  or  if  the  BLACK  lines  are  fiber  optic.  If  selected, 
separate  BLACK  signal  ground  wires  from  BLACK  wire  lines  by  5  centimeters.  When  a  BLACK  sig¬ 
nal  ground  wire  runs  parallel  to  a  BLACK  wire  line  for  30  meters  or  more,  increase  the  separation  to 
15  centimeters.  (See  paragraph  8.42.  for  more  information.) 

A12.4.20.  BLACK  Signal  Ground  Wire  and  BLACK  Power  Line  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1) 
BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential;  or,  (2)  the  line  distance  of  the 
BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspect¬ 
able  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  If  selected,  separate 
BLACK  signal  ground  wires  from  BLACK  power  lines  by  5  centimeters.  When  a  BLACK  signal 
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ground  wire  runs  parallel  to  a  BLACK  power  line  for  30  meters  or  more,  inerease  the  separation  to  15 
centimeters.  (See  paragraph  8.43.  for  more  information.) 

A12.4.21.  BLACK  Signal  Ground  Wire  and  Fortuitous  Conductor  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected  and  fortuitous  conductors  exit  the  inspectable 
space.  Do  not  select  this  countermeasure  if:  (1)  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines 
are  fiber  optic;  or,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  BLACK  signal  ground  wires  from  fortuitous  conductors  by  5  centimeters.  When  BLACK 
signal  ground  wires  run  parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortu¬ 
itous  conductor  and  BLACK  wire  lines  or  BLACK  power  lines  run  parallel  for  30  meters  or  more, 
increase  the  separation  to  15  centimeters.  (See  paragraph  8.44.  for  more  information.) 


AFMAN33-214V2  21  SEPTMEBER  2001 


149 


Attachment  13 

FACILITY  ZONE  B,  EQUIPMENT  ZONE  C 

A13.1.  Introduction.  This  attachment  addresses  the  following  conditions: 

A13.1.1.  Facilities:  Assigned  Zone  B,  or  more  than  20  meters  but  less  than  100  meters  of  inspectable 
space. 

A13.1.2.  Equipment:  Assigned  Zone  C,  or  the  ERTZ  more  than  20  meters  but  less  than  100  meters;  or 
meets  NSTISSAM/TEMPEST  1-92,  Eevel  III  standards,  or  all  other  RED  equipment. 

NOTE:  This  installation  may  cause  TEMPEST  hazards.  If  the  facility  is  TEMPEST-zoned  and  using 
TEMPEST- zoned  equipment,  contact  the  CTTA  to  evaluate  the  actual  TEMPEST  zone  test  results  for  the 
equipment  and  the  facility  to  determine  if  using  the  equipment  in  the  facility  is  possible. 

AI3.2.  Countermeasure  Application. 

A 13. 2.1.  Review  the  need  for  each  required  countermeasure.  Select  it  if  it  is  needed. 

A13.2.2.  Review  the  need  for  each  consider  countermeasure.  Do  not  select  it  unless  it  is  needed. 

A13.2.3.  Eor  existing  facilities,  when  countermeasures  involving  BEACK  equipment,  BEACK  wire 
lines,  BEACK  power  lines,  and  fortuitous  conductors  cannot  be  met,  the  user  may  request  an  EMSEC 
test  to  determine  if  countermeasures  are  needed. 

AI3.3.  Required  Countermeasures.  Select  each  required  countermeasure  unless  the  threat  at  which  the 
countermeasure  is  aimed  does  not  exist.  Explain  why  each  required  countermeasure  not  selected  was  not 
selected.  A  waiver  is  not  needed  for  any  deselected  required  countermeasure  since  the  requirement  for 
protection  has  been  met. 

A13.3.1.  Inspectable  Space.  This  countermeasure  is  required.  Specify  the  minimum  inspectable 
space  (distance)  required  to  contain  radiated  compromising  emanations.  (See  paragraphs  8.4.  and  8.5. 
for  more  information.) 

A1 3.3.2.  RED  Equipment  and  BEACK  Equipment  Separation.  This  countermeasure  is  required  if 
BEACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space  unless:  (1)  the  line  distance  of 
the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines  are  fiber  optic;  and,  (2)  BEACK 
power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds 
100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See  paragraph  8.8.  for  more  information.) 

A13.3.2.1.  Separate  RED  equipment  from  BEACK  equipment  by  1  meter. 

A13.3.2.1.1.  The  separation  distance  is  reduced  to  15  centimeters  if  a  BEACK  wire  line  isola¬ 
tion  countermeasure  is  used. 

A13.3.2.1.2.  If  the  user  cannot  achieve  this  separation,  use  a  BEACK  wire  line  isolation  coun¬ 
termeasure,  filter  BEACK  power  lines,  and  isolate  fortuitous  conductors. 

A13.3.2.2.  Do  not  place  BEACK  equipment  on  the  same  metal  desktop,  metal  bench  surface, 
metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment. 
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A 13. 3. 3.  RED  Equipment  and  BEACK  Wire  Eine  Separation.  This  countermeasure  is  required  for 
BEACK  wire  lines  that  exit  the  inspectable  space  unless  the  line  distance  of  the  BEACK  wire  lines 
from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  2,000  meters  or  if  the  BEACK  lines  are  fiber  optic.  (See  paragraph  8.9.  for  more  information.) 

A13.3.3.1.  Separate  RED  equipment  from  BEACK  wire  lines  by  1  meter. 

A13.3.3.1.1.  The  separation  distance  is  reduced  to  centimeters  if  the  BEACK  wire  lines  are 
shielded,  or, 

A13.3.3.1.2.  The  separation  distance  is  reduced  to  15  centimeters  if  a  BEACK  wire  line  isola¬ 
tion  countermeasure  is  used. 

A13.3.3.2.  If  the  user  cannot  achieve  this  separation,  use  a  BEACK  wire  line  isolation  counter¬ 
measure,  filter  BEACK  power  lines,  and  isolate  fortuitous  conductors. 

A 13. 3. 4.  RED  Equipment  and  BEACK  Power  Eine  Separation.  This  countermeasure  is  required 
unless:  (1)  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt- amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  dis¬ 
tance  of  BEACK  wire  lines  connected  to  BEACK  equipment  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BEACK  lines 
are  fiber  optic.  (See  paragraph  8.10.  for  more  information.) 

A13.3.4.1.  Separate  RED  equipment  from  BEACK  power  lines  by  1  meter. 

A13.3.4.1.1.  The  separation  distance  is  reduced  to  5  centimeters  if  the  BEACK  power  lines 
are  shielded. 

A13.3.4.1.2.  If  the  user  cannot  achieve  this  separation,  use  a  BEACK  wire  line  isolation  coun¬ 
termeasure,  filter  BEACK  power  lines,  and  isolate  fortuitous  conductors. 

A13.3.5.  RED  Equipment  and  Eortuitous  Conductor  Separation.  This  countermeasure  is  required  for 
fortuitous  conductors  that  exit  the  inspectable  space,  BEACK  wires  that  exit  the  inspectable  space, 
and  BEACK  power  lines  unless:  (1)  the  line  distance  of  the  BEACK  wire  lines  from  the  building  con¬ 
taining  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  250  meters  or  the 
BEACK  lines  are  fiber  optic;  and,  (2)  BEACK  power  lines  are  contained  within  the  inspectable  space 
up  to  a  point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 
(See  paragraph  8.12.  for  more  information.) 

A13.3.5.1.  Separate  RED  equipment  from  fortuitous  conductors  by  1  meter. 

A1 3. 3. 5. 1.1.  If  the  user  cannot  achieve  this  separation,  use  a  BEACK  wire  line  isolation  coun¬ 
termeasure,  filter  BEACK  power  lines,  and  isolate  fortuitous  conductors. 

A13.3.6.  RED  Wire  Eine  and  BEACK  Wire  Eine  Separation.  This  countermeasure  is  required  if 
BEACK  wire  lines  exit  the  inspectable  space  unless  the  line  distance  of  the  BEACK  wire  lines  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than 
2,000  meters  or  if  the  BEACK  lines  are  fiber  optic.  (See  paragraph  8.17.  for  more  information.) 

A13.3.6.1.  Separate  RED  wire  lines  from  BEACK  wire  lines  by  5  centimeters. 

A13.3.6.1.1.  Do  not  place  RED  and  BEACK  wire  lines  in  a  common  distribution  facility.  It  is 
permitted  to  use  a  common  distribution  facility  for  RED  and  BEACK  fiber  optic  signal  lines 
provided: 
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A13.3.6.1.1.1.  Either  the  BLACK  or  the  RED  fiber  optic  signal  lines  in  a  RED  distribu¬ 
tion  facility  must  have  an  opaque  sheath.  BLACK  fiber  optic  signal  lines  should  not  have 
metallic  stiffeners  or  sheaths.  If  they  do,  treat  the  stiffeners  or  sheaths  as  fortuitous  conduc¬ 
tors  and  ground  both  ends  of  the  stiffeners  or  sheaths  if  the  BLACK  fiber  optic  signal  lines 
leave  the  inspectable  space. 

A13.3.6.1.1.2.  Separate  RED  fiber  optic  signal  lines  in  BLACK  distribution  facilities 
from  the  distribution  facility  before  the  distribution  facility  exits  the  CAA. 

A13.3.6.1.1.3.  Using  multifiber  bundle  for  both  RED  and  BLACK  signals  is  not  recom¬ 
mended.  If  used,  an  opaque  partition  between  the  RED  and  BLACK  fibers  is  required. 
Maintain  total  accountability  of  all  fibers  to  preclude  compromise  through  misconnection. 

A13.3.6.2.  When  RED  and  BLACK  wire  lines  are  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters. 

A 13. 3. 7.  RED  Wire  Line  and  BLACK  Power  Line  Separation.  This  countermeasure  is  required 
unless:  (1)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  dis¬ 
tance  of  the  BLACK  wire  line  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  (See  paragraph 
8.18.  for  more  information.) 

A13.3.7.1.  Separate  RED  wire  lines  from  BLACK  power  lines  by  5  centimeters. 

A 13. 3. 7. 2.  When  RED  wire  lines  and  BLACK  power  lines  are  run  parallel  for  30  meters  or  more, 
increase  the  separation  to  15  centimeters. 

A 13. 3. 8.  Shielded  RED  Wire  Lines.  This  countermeasure  is  required  for  RED  equipment  meeting  the 
requirements  of  NSTISSAM/TEMPEST  1-92,  Level  I,  which  must  use  optical  or  shielded  wire  cables 
if  specified  as  part  of  the  manufacturer’s  installation  specification  or  if  specified  for  compliance  with 
TEMPEST  certification.  (See  paragraph  8.23.  for  more  information.) 

A13.3.9.  RED  Power.  This  countermeasure  is  required  if  the  facility  contains  BLACK  equipment 
with  signal  wire  lines  that  exit  the  inspectable  space  unless:  (1)  the  line  distance  of  the  BLACK  wire 
lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is 
greater  than  1,000  meters  or  if  the  BLACK  lines  are  fiber  optic,  or,  a  BLACK  wire  line  isolation  coun¬ 
termeasure  is  used;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a 
point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See 
paragraph  8.27.  for  more  information.) 

A13.3.9.1.  Do  not  power  TEMPEST-certified,  cryptographic  (unless  required  in  technical  manu¬ 
als),  or  BLACK  equipment  from  a  RED  power  circuit. 

A13.3.10.  Entered  RED  Power.  This  countermeasure  is  required  unless  the  power  lines  feeding  the 
facility  containing  the  RED  equipment  are  contained  within  the  inspectable  space  up  to  a  point  where 
the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See  paragraph 
8.28.  for  more  information.) 

A13.3.10.1.  Do  not  power  TEMPEST-certified,  cryptographic  (unless  required  in  technical  man¬ 
uals),  or  BLACK  equipment  from  a  filtered  RED  power  circuit. 

A 13. 3. 11.  Administrative  Communications  Countermeasures.  These  countermeasures  are  required. 
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A13.3.11.1.  BLACK  Telephone  Systems.  Do  not  place  the  telephone  instrument  on  the  same 
metal  desktop,  metal  bench  surface,  metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment.  (See 
paragraph  8.52.  for  more  information.) 

A13.3.12.  Timing  and  Control  Lines.  This  countermeasure  is  required.  Follow  the  guidance  in  para¬ 
graph  8.59. 

A13.3.13.  Utility  Control  Cables.  This  countermeasure  is  required.  Follow  the  guidance  in  paragraph 

8.60. 


A13.4.  Countermeasures  to  Consider.  Do  not  select  a  consider  countermeasure  unless  the  threat  at 
which  the  countermeasure  is  aimed  does  exist.  Explain  (justify)  why  a  not-required  (consider)  counter¬ 
measure  was  selected. 

A 1 3 .4. 1 .  RED  Equipment  and  BLACK  Signal  Ground  Wire  Separation.  Consider  applying  this  coun¬ 
termeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if  the  line  distance 
of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  If  selected,  separate 
RED  equipment  from  BLACK  signal  ground  wires  by  1  meter.  If  a  BLACK  wire  line  isolation  coun¬ 
termeasure  is  used,  the  separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.11.  for  more 
information.) 

A13.4.2.  RED  Wire  Line  and  BLACK  Equipment  Separation.  Consider  applying  this  countermea¬ 
sure  if  BLACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space.  Do  not  select  this 
countermeasure  if  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BLACK  lines 
are  fiber  optic.  If  selected,  separate  RED  wire  lines  from  BLACK  equipment  by  1  meter.  If  a  BLACK 
wire  line  isolation  countermeasure  is  used,  the  separation  distance  is  reduced  to  15  centimeters.  (See 
paragraph  8.16.  for  more  information.) 

A13.4.3.  RED  Wire  Line  and  BLACK  Signal  Ground  Wire  Separation.  Consider  applying  this  coun¬ 
termeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if  the  line  distance 
of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  If  selected,  separate 
RED  wire  lines  from  BLACK  signal  ground  wires  by  5  centimeters.  When  RED  wire  lines  run  paral¬ 
lel  to  BLACK  signal  ground  wires  for  30  meters  or  more,  increase  the  separation  to  15  centimeters. 
(See  paragraph  8.19.  for  more  information.) 

A 13. 4. 4.  RED  Wire  Line  and  Fortuitous  Conductor  Separation.  Consider  applying  this  countermea¬ 
sure  if  fortuitous  conductors  exit  the  inspectable  space.  Do  not  select  this  countermeasure  if:  (1)  the 
line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  bound¬ 
ary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines  are  fiber  optic;  or  (2) 
BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  RED  wire  lines 
from  fortuitous  conductors  by  5  centimeters.  When  RED  wire  lines  run  parallel  to  a  fortuitous  conduc¬ 
tor  for  30  meters  or  more  and  the  same  fortuitous  conductor  runs  parallel  to  BLACK  wire  lines  or 
BLACK  power  lines  for  30  meters  or  more,  increase  separation  to  15  centimeters.  (See  paragraph 
8.20.  for  more  information.) 
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A13.4.5.  Shielded  BLACK  Wire  Lines.  Consider  applying  this  countermeasure  when  BLACK  wire 
lines  are  not  separated  by  the  required  distance  from  RED  equipment,  RED  wire  lines,  RED  power 
lines,  RED  signal  ground  wires,  BEACK  signal  ground  wires,  or  fortuitous  conductors.  (1)  Do  not 
select  this  countermeasure  if  the  required  separation  distance  for  RED  equipment,  RED  power  lines, 
RED  signal  ground  wires,  BEACK  signal  ground  wires,  or  fortuitous  conductors  from  BEACK  wire 
lines  is  not  met,  but,  the  line  distance  of  the  BEACK  wire  lines  connected  to  BEACK  equipment  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than 
1,000  meters  or  the  BEACK  lines  are  fiber  optic.  (2)  Do  not  select  this  countermeasure  if  the  required 
separation  distance  for  RED  wire  lines  from  BEACK  wire  lines  is  not  met,  but  the  line  distance  of  the 
BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspect¬ 
able  space  is  greater  than  2,000  meters  or  the  BEACK  lines  are  fiber  optic.  Attachment  18  contains 
specifications  for  shielded  cables.  (See  paragraph  8.24.  for  more  information.) 

A13.4.5.L  If  the  selection  of  this  countermeasure  concerns  fortuitous  conductors,  do  not  apply  it 
unless  RED  wire  lines,  RED  signal  ground  wires,  or  BEACK  signal  ground  wires  run  parallel 
within  5  centimeters  of  a  fortuitous  conductor  for  30  meters  or  more,  and  BEACK  wire  lines  also 
run  parallel  within  5  centimeters  of  the  same  fortuitous  conductor  for  30  meters  or  more. 

A13.4.5.2.  This  countermeasure  is  not  needed  if  there  is  at  least  1  meter  separation  between  a  par¬ 
allel  RED  wire  line  and  a  BEACK  wire  line  or  a  common  fortuitous  conductor  run. 

A13.4.6.  RED  Power  Eine  and  BEACK  Equipment  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  selected  and  BEACK  equipment  has  signal  wire  lines  that  exit  the  inspectable 
space.  Do  not  select  this  countermeasure  if:  (1)  the  line  distance  of  the  BEACK  wire  lines  from  the 
building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000 
meters,  the  BEACK  lines  are  fiber  optic,  or  a  BEACK  line  isolation  countermeasure  is  used;  and,  (2) 
BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  RED  power 
lines  from  BEACK  equipment  by  1  meter.  If  a  BEACK  wire  line  isolation  countermeasure  is  used,  the 
separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.29.  for  more  information.) 

A 13. 4.7.  RED  Power  Eine  and  BEACK  Wire  Eine  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  selected  and  BEACK  wire  lines  exit  the  inspectable  space.  Do  not  select  this 
countermeasure  if  the  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines 
are  fiber  optic.  If  selected,  separate  RED  power  lines  from  BEACK  wire  lines  by  5  centimeters.  When 
RED  power  lines  and  BEACK  signal  ground  wires  are  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.30.  for  more  information.) 

A 13. 4. 8.  RED  Power  Eine  and  BEACK  Power  Eine  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  selected.  Do  not  select  this  countermeasure  if:  (1)  BEACK  power  lines  are  con¬ 
tained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds  100,000 
volt- amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the  BEACK  wire  lines 
from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  1,000  meters  or  if  the  BEACK  lines  are  fiber  optic.  If  selected,  separate  RED  power  lines  from 
BEACK  power  lines  by  5  centimeters.  When  RED  power  lines  and  BEACK  power  lines  are  run  par¬ 
allel  for  30  meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph  8.31.  for  more 
information.) 
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A 13. 4. 9.  RED  Power  Line  and  BLACK  Signal  Ground  Wire  Separation.  Consider  applying  this 
eountermeasure  if  the  RED  power  and  BLACK  signal  ground  countermeasures  are  selected.  Do  not 
select  this  countermeasure  if:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the  building  contain¬ 
ing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the 
BLACK  lines  are  fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space 
up  to  a  point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 
If  selected,  separate  RED  power  lines  from  BLACK  signal  ground  wires  by  5  centimeters.  When  RED 
power  lines  and  BLACK  signal  ground  wires  are  run  parallel  for  30  meters  or  more,  increase  the  sep¬ 
aration  to  15  centimeters.  (See  paragraph  8.32.  for  more  information.) 

A13.4.10.  RED  Power  Line  and  Lortuitous  Conductor  Separation.  Consider  applying  this  counter¬ 
measure  if  RED  power  is  selected  and  fortuitous  conductors  exit  the  inspectable  space.  Do  not  select 
this  countermeasure  if:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines 
are  fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  power  lines  from  fortuitous  conductors  by  5  centimeters.  When  RED  power  lines  run 
parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortuitous  conductor  and 
BLACK  wire  lines  or  BLACK  power  lines  run  parallel  for  30  meters  or  more,  increase  the  separation 
to  15  centimeters.  (See  paragraph  8.33.  for  more  information.) 

A13.4.11.  RED  Signal  Ground.  Consider  applying  this  countermeasure  if  RED  equipment  needs  a 
signal  ground,  RED  power  filters  or  cryptographic  equipment  are  installed  in  facility,  or  RED  wire 
lines  are  shielded.  Do  not  select  this  countermeasure  if  the  facility  is  completely  contained  within  the 
inspectable  space.  (See  paragraph  8.35.  for  more  information.) 

A 13. 4. 12.  BLACK  Signal  Ground.  Consider  applying  this  countermeasure  if  BLACK  wire  line  fil¬ 
ters  or  cryptographic  equipment  are  installed  in  the  facility  or  BLACK  wire  lines  are  shielded.  (See 
paragraph  8.35.  for  more  information.) 

A 13. 4. 12.1.  Do  not  select  this  countermeasure  if  the  facility  is  completely  contained  within  the 

inspectable  space. 

A13.4.12.2.  Do  not  use  BLACK  signal  ground  as  the  signal  ground  for  BLACK  equipment; 

BLACK  signal  ground  carries  compromising  emanations. 

A13.4.13.  RED  Signal  Ground  Wire  and  BLACK  Equipment  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected  and  BLACK  equipment  has  signal  wire  lines 
which  exit  the  inspectable  space.  Do  not  select  this  countermeasure  if:  (1)  the  line  distance  of  the 
BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspect¬ 
able  space  is  greater  than  1,000  meters  or  if  the  BLACK  lines  are  fiber  optic;  and,  (2)  BLACK  power 
lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds  100,000 
volt-amperes  and  at  least  10,000  volts  potential.  Do  not  select  this  countermeasure  if  the  facility  is 
completely  contained  within  the  inspectable  space.  If  selected,  separate  RED  signal  ground  wires 
from  BLACK  equipment  by  1  meter.  If  a  BLACK  wire  line  isolation  countermeasure  is  used,  the  sep¬ 
aration  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.36.  for  more  information.) 

A13.4.14.  RED  Signal  Ground  Wire  and  BLACK  Wire  Line  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected  and  BLACK  wire  lines  exit  the  inspectable  space. 
Do  not  select  this  countermeasure  if  the  line  distance  of  the  BLACK  wire  lines  from  the  building  con- 
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taining  the  RED  equipment  to  the  boundary  of  the  inspeetable  space  is  greater  than  2,000  meters  or  if 
the  BLACK  lines  are  fiber  optic.  If  selected,  separate  RED  signal  ground  wires  from  BLACK  wire 
lines  by  5  centimeters.  When  RED  signal  ground  wires  run  parallel  to  BLACK  wire  lines  for  30 
meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph  8.37.  for  more  information.) 

A13.4.15.  RED  Signal  Ground  Wire  and  BLACK  Power  Line  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1)  BLACK 
power  lines  are  contained  within  the  inspeetable  space  up  to  a  point  where  the  average  load  exceeds 
100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the  BLACK  wire 
lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspeetable  space  is 
greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  If  selected,  separate  RED  wire  lines 
from  BLACK  power  lines  by  5  centimeters.  When  RED  signal  ground  wires  run  parallel  to  BLACK 
power  lines  for  30  meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph  8.38.  for 
more  information.) 

A13.4. 16.  RED  Signal  Ground  Wire  and  BLACK  Signal  Ground  Wire  Separation.  Consider  applying 
this  countermeasure  if  RED  and  BLACK  signal  grounds  are  selected.  Do  not  select  this  countermea¬ 
sures  if:  (1)  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspeetable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are 
fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspeetable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  signal  ground  wires  from  BLACK  signal  ground  wires  by  5  centimeters.  When  RED 
signal  ground  wires  run  parallel  to  BLACK  signal  ground  wires  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.39.  for  more  information.) 

A13.4.17.  RED  Signal  Ground  Wire  and  Lortuitous  Conductor  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected  and  fortuitous  conductors  exit  the  inspeetable 
space.  Do  not  select  this  countermeasure  if:  (1)  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspeetable  space  is  more  than  250  meters  or  the  BLACK  lines 
are  fiber  optic;  or,  (2)  BLACK  power  lines  are  contained  within  the  inspeetable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  signal  ground  wires  from  fortuitous  conductor  by  5  centimeters.  When  RED  signal 
ground  wires  run  parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortuitous  con¬ 
ductor  and  BLACK  wire  lines  or  BLACK  power  lines  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.40.  for  more  information.) 

A13.4.18.  BLACK  Signal  Ground  Wire  and  BLACK  Equipment  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1)  the  line 
distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary 
of  the  inspeetable  space  is  more  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic;  and,  (2) 
BLACK  power  lines  are  contained  within  the  inspeetable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  BLACK  signal 
ground  wires  from  BLACK  equipment  by  1  meter.  If  a  BLACK  wire  line  isolation  countermeasure  is 
used,  the  separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.41.  for  more  information.) 

A13.4.19.  BLACK  Signal  Ground  Wire  and  BLACK  Wire  Line  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if  the  line  dis¬ 
tance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of 
the  inspeetable  space  is  greater  than  2,000  meters  or  if  the  BLACK  lines  are  fiber  optic.  If  selected. 
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separate  BLACK  signal  ground  wires  from  BLACK  wire  lines  by  5  centimeters.  When  a  BLACK  sig¬ 
nal  ground  wire  runs  parallel  to  a  BLACK  wire  line  for  30  meters  or  more,  increase  the  separation  to 
15  centimeters.  (See  paragraph  8.42.  for  more  information.) 

A13.4.20.  BLACK  Signal  Ground  Wire  and  BLACK  Power  Line  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1) 
BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the 
BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspect¬ 
able  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  If  selected,  separate 
BLACK  signal  ground  wires  from  BLACK  power  lines  by  5  centimeters.  When  a  BLACK  signal 
ground  wire  runs  parallel  to  a  BLACK  power  line  for  30  meters  or  more,  increase  the  separation  to  15 
centimeters.  (See  paragraph  8.43.  for  more  information.) 

A13.4.2L  BLACK  Signal  Ground  Wire  and  Fortuitous  Conductor  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected  and  fortuitous  conductors  exit  the  inspectable 
space.  Do  not  select  this  countermeasure  if:  (1)  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BEACK  lines 
are  fiber  optic;  or,  (2)  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  BEACK  signal  ground  wires  from  fortuitous  conductors  by  5  centimeters.  When  BEACK 
signal  ground  wires  run  parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortu¬ 
itous  conductor  and  BEACK  wire  lines  or  BEACK  power  lines  run  parallel  for  30  meters  or  more, 
increase  the  separation  to  15  centimeters.  (See  paragraph  8.44.  for  more  information.) 

A13.4.22.  Administrative  Communications  Countermeasures.  Consider  applying  these  counter-mea¬ 
sures. 

A13.4.22.L  BEACK  Intercom  and  Public  Address  Systems.  If  selected,  use  paragraph  A12.2.2. 

(See  paragraph  8.53.  for  more  information.) 

A13.4.22.2.  Comfort  Music  Systems.  If  selected,  use  paragraph  A12.3.2.  (See  paragraph  8.55.  for 

more  information.) 

A13.4.22.3.  BEACK  Cable  TV  Systems.  If  selected,  use  paragraph  A12.4.2.  (See  paragraph  8.56. 

for  more  information.)  When  selected: 

A13.4.22.3.L  Separate  the  TV  set  from  RED  equipment  by  2  meters. 

A13.4.22.3.2.  Separate  video  cables  from  RED  equipment,  RED  wire  lines,  RED  power  lines, 
and  RED  signal  ground  wires  by  2  meters. 

A13.4.22.3.3.  Separate  active  splitters  or  amplifiers  from  RED  equipment,  RED  wire  lines, 
RED  power  lines,  and  RED  signal  ground  wires  by  2  meters. 

A13.4.22.4.  BEACK  TV-VCR  Systems.  If  selected,  use  paragraph  A12.5.2.  (See  paragraph  8.57. 

for  more  information.) 
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Attachment  14 

FACILITY  ZONE  C,  EQUIPMENT  ZONE  C 

A14.1.  Introduction.  This  attachment  addresses  the  following  conditions: 

A14.1.1.  Facilities:  Assigned  Zone  C,  or  more  than  100  meters  of  inspectable  space. 

A14. 1.2.  Equipment:  Assigned  Zone  C,  or  the  ERTZ  more  than  20  meters  but  less  than  100  meters,  or 
meets  NSTISSAM/TEMPEST  1-92,  Eevel  III  standards,  or  all  other  RED  equipment. 

AI4.2.  Countermeasure  Application. 

A14.2.1.  Review  the  need  for  each  required  countermeasure.  Select  it  if  it  is  needed. 

A14.2.2.  Review  the  need  for  each  consider  countermeasure.  Do  not  select  it  unless  it  is  needed. 

A14.2.3.  Eor  existing  facilities,  when  countermeasures  involving  BEACK  equipment,  BEACK  wire 
lines,  BEACK  power  lines,  and  fortuitous  conductors  cannot  be  met,  the  user  may  request  an  EMSEC 
test  to  determine  if  countermeasures  are  needed. 

AI4.3.  Required  Countermeasures.  Select  each  required  countermeasure  unless  the  threat  at  which  the 
countermeasure  is  aimed  does  not  exist.  Explain  why  each  required  countermeasure  not  selected  was  not 
selected.  A  waiver  is  not  needed  for  any  deselected  required  countermeasure  since  the  requirement  for 
protection  has  been  met. 

A14.3.1.  Inspectable  Space.  This  countermeasure  is  required.  Specify  the  minimum  inspectable 
space  (distance)  required  to  contain  radiated  compromising  emanations.  (See  paragraphs  8.4.  and  8.5. 
for  more  information.) 

A14.3.2.  RED  Equipment  and  BEACK  Equipment  Separation.  This  countermeasure  is  required  if 
BEACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space  unless:  (1)  the  line  distance  of 
the  BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines  are  fiber  optic;  and,  (2)  BEACK 
power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds 
100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See  paragraph  8.8.  for  more  information.) 

A14.3.2.1.  Separate  RED  equipment  from  BEACK  equipment  by  0.5  meters. 

A14.3.2.1.1.  The  separation  distance  is  reduced  to  15  centimeters  if  a  BEACK  wire  line  isola¬ 
tion  countermeasure  is  used. 

A14.3.2. 1 .2.  If  the  user  cannot  achieve  this  separation,  use  a  BEACK  wire  line  isolation  coun¬ 
termeasure,  filter  BEACK  power  lines,  and  isolate  fortuitous  conductors. 

A14.3.2.2.  Do  not  place  BEACK  equipment  on  the  same  metal  desktop,  metal  bench  surface, 
metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment. 

A14.3.3.  RED  Equipment  and  BEACK  Wire  Eine  Separation.  This  countermeasure  is  required  for 
BEACK  wire  lines  that  exit  the  inspectable  space  unless  the  line  distance  of  the  BEACK  wire  lines 
from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  2,000  meters  or  if  the  BEACK  lines  are  fiber  optic.  (See  paragraph  8.9.  for  more  information.) 

A14.3.3.1.  Separate  RED  equipment  from  BEACK  wire  lines  by  1  meter. 
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A14.3.3.1.1.  The  separation  distance  is  reduced  to  5  centimeters  if  the  BLACK  wire  lines  are 
shielded,  or, 

A14.3.3.1.2.  The  separation  distance  is  reduced  to  15  centimeters  if  a  BLACK  wire  line  isola¬ 
tion  countermeasure  is  used. 

A14.3.3.2.  If  the  user  cannot  achieve  this  separation,  use  a  BLACK  wire  line  isolation  counter¬ 
measure,  filter  BLACK  power  lines,  and  isolate  fortuitous  conductors. 

A14.3.4.  RED  Equipment  and  BEACK  Power  Eine  Separation.  This  countermeasure  is  required 
unless:  (1)  the  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the 
average  load  exceeds  100,000  volt- amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  dis¬ 
tance  of  BEACK  wire  lines  connected  to  BEACK  equipment  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BEACK  lines 
are  fiber  optic.  (See  paragraph  8.10.  for  more  information.) 

A14.3.4.L  Separate  RED  equipment  from  BEACK  power  lines  by  1  meter. 

A14.3.4.LL  The  separation  distance  is  reduced  to  5  centimeters  if  the  BEACK  power  lines 
are  shielded. 

A14.3.4. 1.2.  If  the  user  cannot  achieve  this  separation,  use  a  BEACK  wire  line  isolation  coun¬ 
termeasure,  filter  BEACK  power  lines,  and  isolate  fortuitous  conductors. 

A14.3.5.  RED  Wire  Eine  and  BEACK  Wire  Eine  Separation.  This  countermeasure  is  required  if 
BEACK  wire  lines  exit  the  inspectable  space  unless  the  line  distance  of  the  BEACK  wire  lines  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than 
2,000  meters  or  if  the  BEACK  lines  are  fiber  optic.  (See  paragraph  8.17.  for  more  information.) 

A14.3.5.L  Separate  RED  wire  lines  from  BEACK  wire  lines  by  5  centimeters. 

A14.3.5.LL  Do  not  place  RED  and  BEACK  wire  lines  in  a  common  distribution  facility.  It  is 
permitted  to  use  a  common  distribution  facility  for  RED  and  BEACK  fiber  optic  signal  lines 
provided: 

A14.3.5.LLL  Either  the  BEACK  or  the  RED  fiber  optic  signal  lines  in  a  RED  distribu¬ 
tion  facility  must  have  an  opaque  sheath.  BEACK  fiber  optic  signal  lines  should  not  have 
metallic  stiffeners  or  sheaths.  If  they  do,  treat  the  stiffeners  or  sheaths  as  fortuitous  conduc¬ 
tors  and  ground  both  ends  of  the  stiffeners  or  sheaths  if  the  BEACK  fiber  optic  signal  lines 
leave  the  inspectable  space. 

A14.3.5.LL2.  Separate  RED  fiber  optic  signal  lines  in  BEACK  distribution  facilities 
from  the  distribution  facility  before  the  distribution  facility  exits  the  CAA. 

A14.3.5.LL3.  Using  multifiber  bundle  for  both  RED  and  BEACK  signals  is  not  recom¬ 
mended.  If  used,  an  opaque  partition  between  the  RED  and  BEACK  fibers  is  required. 
Maintain  total  accountability  of  all  fibers  to  preclude  compromise  through  misconnection. 

A14.3.5.2.  When  RED  and  BEACK  wire  lines  are  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters. 

A 14. 3. 6.  Shielded  RED  Wire  Eines.  This  countermeasure  is  required  for  RED  equipment  meeting  the 
requirements  of  NSTISSAM/TEMPEST  1-92,  Eevel  I,  which  must  use  optical  or  shielded  wire  cables 
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if  specified  as  part  of  the  manufacturer’s  installation  specification  or  if  specified  for  compliance  with 
TEMPEST  certification.  (See  paragraph  8.23.  for  more  information.) 

A14.3.7.  RED  Power.  This  countermeasure  is  required  if  the  facility  contains  BEACK  equipment 
with  signal  wire  lines  that  exit  the  inspectable  space  unless:  (1)  the  line  distance  of  the  BEACK  wire 
lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is 
greater  than  1,000  meters  or  if  the  BLACK  lines  are  fiber  optic,  or,  a  BLACK  wire  line  isolation  coun¬ 
termeasure  is  used;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a 
point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  (See 
paragraph  8.27.  for  more  information.) 

A14.3.7.1.  Do  not  power  TEMPEST-certified,  cryptographic  (unless  required  in  technical  manu¬ 
als),  or  BLACK  equipment  from  a  RED  power  circuit. 

A 14. 3. 8.  Administrative  Communications  Countermeasures.  These  countermeasures  are  required. 

A14.3.8. 1 .  BLACK  Telephone  Systems.  Do  not  place  the  telephone  instrument  on  the  same  metal 
desktop,  metal  bench  surface,  metal  shelf,  or  metal  cabinet  top  as  the  RED  equipment.  (See  para¬ 
graph  8.52.  for  more  information.) 

A14.3.9.  Timing  and  Control  Lines.  This  countermeasure  is  required.  Eollow  the  guidance  in  para¬ 
graph  8.59. 

A14.3.10.  Utility  Control  Cables.  This  countermeasure  is  required.  Eollow  the  guidance  in  paragraph 

8.60. 


A14.4.  Countermeasures  to  Consider.  Do  not  select  a  consider  countermeasure  unless  the  threat  at 
which  the  countermeasure  is  aimed  does  exist.  Explain  (justify)  why  a  not-required  (consider)  counter¬ 
measure  was  selected. 

A  14.4. 1 .  RED  Equipment  and  BLACK  Signal  Ground  Wire  Separation.  Consider  applying  this  coun¬ 
termeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if  the  line  distance 
of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  If  selected,  separate 
RED  equipment  from  BLACK  signal  ground  wires  by  0.5  meters.  If  a  BLACK  wire  line  isolation 
countermeasure  is  used,  the  separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.11.  for 
more  information.) 

A14.4.2.  RED  Wire  Line  and  BLACK  Equipment  Separation.  Consider  applying  this  countermea¬ 
sure  if  BLACK  equipment  has  signal  wire  lines  that  exit  the  inspectable  space.  Do  not  select  this 
countermeasure  if  the  line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BLACK  lines 
are  fiber  optic.  If  selected,  separate  RED  wire  lines  from  BLACK  equipment  by  0.5  meters.  If  a 
BLACK  wire  line  isolation  countermeasure  is  used,  the  separation  distance  is  reduced  to  15  centime¬ 
ters.  (See  paragraph  8.16.  for  more  information.) 

A  14.4.3.  RED  Wire  Line  and  BLACK  Power  Line  Separation.  Consider  applying  this  countermea¬ 
sure.  Do  not  select  this  countermeasure  if:  (1)  BLACK  power  lines  are  contained  within  the  inspect¬ 
able  space  up  to  a  point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000 
volts  potential;  and,  (2)  the  line  distance  of  the  BLACK  wire  line  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BLACK 
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lines  are  fiber  optic.  If  selected,  separate  RED  wire  lines  from  BLACK  power  lines  by  5  centimeters. 
If  selected,  when  RED  wire  lines  and  BLACK  power  lines  are  run  parallel  for  30  meters  or  more, 
increase  the  separation  to  15  centimeters.  (See  paragraph  8.18.  for  more  information.) 

A  14.4.4.  RED  Wire  Line  and  BLACK  Signal  Ground  Wire  Separation.  Consider  applying  this  coun¬ 
termeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if  the  line  distance 
of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the 
inspectable  space  is  greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  If  selected,  separate 
RED  wire  lines  from  BLACK  signal  ground  wires  by  5  centimeters.  When  RED  wire  lines  run  paral¬ 
lel  to  BLACK  signal  ground  wires  for  30  meters  or  more,  increase  the  separation  to  15  centimeters. 
(See  paragraph  8.19.  for  more  information.) 

A14.4.5.  RED  Wire  Line  and  Lortuitous  Conductor  Separation.  Consider  applying  this  countermea¬ 
sure  if  fortuitous  conductors  exit  the  inspectable  space.  Do  not  select  this  countermeasure  if:  (1)  the 
line  distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  bound¬ 
ary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines  are  fiber  optic;  or  (2) 
BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  RED  wire  lines 
from  fortuitous  conductors  by  5  centimeters.  When  RED  wire  lines  run  parallel  to  a  fortuitous  conduc¬ 
tor  for  30  meters  or  more  and  the  same  fortuitous  conductor  runs  parallel  to  BLACK  wire  lines  or 
BLACK  power  lines  for  30  meters  or  more,  increase  separation  to  15  centimeters.  (See  paragraph 
8.20.  for  more  information.) 

A14.4.6.  Shielded  BLACK  Wire  Lines.  Consider  applying  this  countermeasure  when  BLACK  wire 
lines  are  not  separated  by  the  required  distance  from  RED  equipment,  RED  wire  lines,  RED  power 
lines,  RED  signal  ground  wires,  BLACK  signal  ground  wires,  or  fortuitous  conductors.  (1)  Do  not 
select  this  countermeasure  if  the  required  separation  distance  for  RED  equipment,  RED  power  lines, 
RED  signal  ground  wires,  BLACK  signal  ground  wires,  or  fortuitous  conductors  from  BLACK  wire 
lines  is  not  met,  but,  the  line  distance  of  the  BLACK  wire  lines  connected  to  BLACK  equipment  from 
the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than 
1,000  meters  or  the  BLACK  lines  are  fiber  optic.  (2)  Do  not  select  this  countermeasure  if  the  required 
separation  distance  for  RED  wire  lines  from  BLACK  wire  lines  is  not  met,  but  the  line  distance  of  the 
BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspect¬ 
able  space  is  greater  than  2,000  meters  or  the  BLACK  lines  are  fiber  optic.  Attachment  18  contains 
specifications  for  shielded  cables.  (See  paragraph  8.24.  for  more  information.) 

A14.4.6.1.  If  the  selection  of  this  countermeasure  concerns  fortuitous  conductors,  do  not  apply  it 
unless  RED  wire  lines,  RED  signal  ground  wires,  or  BLACK  signal  ground  wires  run  parallel 
within  5  centimeters  of  a  fortuitous  conductor  for  30  meters  or  more,  and,  BLACK  wire  lines  also 
run  parallel  within  5  centimeters  of  the  same  fortuitous  conductor  for  30  meters  or  more. 

A14.4.6.2.  This  countermeasure  is  not  needed  if  there  is  at  least  1  meter  separation  between  a  par¬ 
allel  RED  wire  line  and  a  BLACK  wire  line  or  a  common  fortuitous  conductor  run. 

A  14.4.7.  Entered  RED  Power.  Consider  applying  this  countermeasure  if  RED  power  is  required.  Do 
not  select  this  countermeasure  if  the  power  lines  feeding  the  RED  power  circuit  are  contained  within 
the  inspectable  space  up  to  a  point  where  the  average  load  exceeds  100,000  volt- amperes  and  at  least 
10,000  volts  potential.  If  selected,  do  not  power  TEMPEST-certified,  cryptographic  (unless  required 
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in  technical  manuals),  or  BLACK  equipment  from  a  filtered  RED  power  circuit.  (See  paragraph  8.28. 
for  more  information.) 

A  14.4. 8.  RED  Power  Eine  and  BEACK  Equipment  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  selected  and  BEACK  equipment  has  signal  wire  lines  that  exit  the  inspectable 
space.  Do  not  select  this  countermeasure  if:  (1)  the  line  distance  of  the  BEACK  wire  lines  from  the 
building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000 
meters,  the  BEACK  lines  are  fiber  optic,  or  a  BEACK  line  isolation  countermeasure  is  used;,  and,  (2) 
BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  RED  power 
lines  from  BEACK  equipment  by  0.5  meters.  If  a  BEACK  wire  line  isolation  countermeasure  is  used, 
the  separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.29.  for  more  information.) 

A14.4.9.  RED  Power  Eine  and  BEACK  Wire  Eine  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  selected  and  BEACK  wire  lines  exit  the  inspectable  space.  Do  not  select  this 
countermeasure  if  the  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED 
equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines 
are  fiber  optic.  If  selected,  separate  RED  power  lines  from  BEACK  wire  lines  by  5  centimeters.  When 
RED  power  lines  and  BEACK  signal  ground  wires  are  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.30.  for  more  information.) 

A14.4. 10.  RED  Power  Eine  and  BEACK  Power  Eine  Separation.  Consider  applying  this  countermea¬ 
sure  if  RED  power  is  selected.  Do  not  select  this  countermeasure  if:  (1)  BEACK  power  lines  are  con¬ 
tained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds  100,000 
volt- amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the  BEACK  wire  lines 
from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater 
than  1,000  meters  or  if  the  BEACK  lines  are  fiber  optic.  If  selected,  separate  RED  power  lines  from 
BEACK  power  lines  by  5  centimeters.  When  RED  power  lines  and  BEACK  power  lines  are  run  par¬ 
allel  for  30  meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph  8.31.  for  more 
information.) 

A14.4.11.  RED  Power  Eine  and  BEACK  Signal  Ground  Wire  Separation.  Consider  applying  this 
countermeasure  if  the  RED  power  and  BEACK  signal  ground  countermeasures  are  selected.  Do  not 
select  this  countermeasure  if:  (1)  the  line  distance  of  the  BEACK  wire  lines  from  the  building  contain¬ 
ing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the 
BEACK  lines  are  fiber  optic;  and,  (2)  BEACK  power  lines  are  contained  within  the  inspectable  space 
up  to  a  point  where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential. 
If  selected,  separate  RED  power  lines  from  BEACK  signal  ground  wires  by  5  centimeters.  When  RED 
power  lines  and  BEACK  signal  ground  wires  are  run  parallel  for  30  meters  or  more,  increase  the  sep¬ 
aration  to  15  centimeters.  (See  paragraph  8.32.  for  more  information.) 

A14.4.12.  RED  Power  Eine  and  Eortuitous  Conductor  Separation.  Consider  applying  this  counter¬ 
measure  if  RED  power  is  selected  and  fortuitous  conductors  exit  the  inspectable  space.  Do  not  select 
this  countermeasure  if:  (1)  the  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BEACK  lines 
are  fiber  optic;  and,  (2)  BEACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  power  lines  from  fortuitous  conductors  by  5  centimeters.  When  RED  power  lines  run 
parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortuitous  conductor  and 
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BLACK  wire  lines  or  BLACK  power  lines  run  parallel  for  30  meters  or  more,  increase  the  separation 
to  15  centimeters.  (See  paragraph  8.33.  for  more  information.) 

A14.4.13.  RED  Signal  Ground.  Consider  applying  this  countermeasure  if  RED  equipment  needs  a 
signal  ground,  RED  power  filters  or  cryptographic  equipment  are  installed  in  the  facility,  or  RED  wire 
lines  are  shielded.  Do  not  select  this  countermeasure  if  the  facility  is  completely  contained  within  the 
inspectable  space.  (See  paragraph  8.35.  for  more  information.) 

A14.4.14.  BEACK  Signal  Ground.  Consider  applying  this  countermeasure  if  BEACK  wire  line  fil¬ 
ters  or  cryptographic  equipment  are  installed  in  the  facility  or  BEACK  wire  lines  are  shielded.  (See 
paragraph  8.35.  for  more  information.) 

A  14.4. 14.1.  Do  not  select  this  countermeasure  if  the  facility  is  completely  contained  within  the 
inspectable  space. 

A14.4.14.2.  Do  not  use  BEACK  signal  ground  as  the  signal  ground  for  BEACK  equipment; 
BEACK  signal  ground  carries  compromising  emanations. 

A14.4.15.  RED  Signal  Ground  Wire  and  BEACK  Equipment  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected  and  BEACK  equipment  has  signal  wire  lines 
which  exit  the  inspectable  space.  Do  not  select  this  countermeasure  if:  (1)  the  line  distance  of  the 
BEACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspect¬ 
able  space  is  greater  than  1,000  meters  or  if  the  BEACK  lines  are  fiber  optic;  and,  (2)  BEACK  power 
lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds  100,000 
volt-amperes  and  at  least  10,000  volts  potential.  Do  not  select  this  countermeasure  if  the  facility  is 
completely  contained  within  the  inspectable  space.  If  selected,  separate  RED  signal  ground  wires 
from  BEACK  equipment  by  0.5  meters.  If  a  BEACK  wire  line  isolation  countermeasure  is  used,  the 
separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.36.  for  more  information.) 

A14.4.16.  RED  Signal  Ground  Wire  and  BEACK  Wire  Eine  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected  and  BEACK  wire  lines  exit  the  inspectable  space. 
Do  not  select  this  countermeasure  if  the  line  distance  of  the  BEACK  wire  lines  from  the  building  con¬ 
taining  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is  greater  than  2,000  meters  or  if 
the  BEACK  lines  are  fiber  optic.  If  selected,  separate  RED  signal  ground  wires  from  BEACK  wire 
lines  by  5  centimeters.  When  RED  signal  ground  wires  run  parallel  to  BEACK  wire  lines  for  30 
meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph  8.37.  for  more  information.) 

A14.4.17.  RED  Signal  Ground  Wire  and  BEACK  Power  Eine  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1)  BEACK 
power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds 
100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the  BEACK  wire 
lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is 
greater  than  1,000  meters  or  the  BEACK  lines  are  fiber  optic.  If  selected,  separate  RED  signal  ground 
wires  from  BEACK  power  lines  by  5  centimeters.  When  RED  signal  ground  wires  run  parallel  to 
BEACK  power  lines  for  30  meters  or  more,  increase  the  separation  to  15  centimeters.  (See  paragraph 
8.38.  for  more  information.) 

A14.4. 18.  RED  Signal  Ground  Wire  and  BEACK  Signal  Ground  Wire  Separation.  Consider  applying 
this  countermeasure  if  RED  and  BEACK  signal  grounds  are  selected.  Do  not  select  this  countermea¬ 
sures  if:  (1)  the  line  distance  of  the  BEACK  wire  lines  from  the  building  containing  the  RED  equip¬ 
ment  to  the  boundary  of  the  inspectable  space  is  greater  than  1,000  meters  or  the  BEACK  lines  are 
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fiber  optic;  and,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  signal  ground  wires  from  BLACK  signal  ground  wires  by  5  centimeters.  When  RED 
signal  ground  wires  run  parallel  to  BLACK  signal  ground  wires  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.39.  for  more  information.) 

A14.4.19.  RED  Signal  Ground  Wire  and  Eortuitous  Conductor  Separation.  Consider  applying  this 
countermeasure  if  a  RED  signal  ground  is  selected  and  fortuitous  conductors  exit  the  inspectable 
space.  Do  not  select  this  countermeasure  if:  (1)  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines 
are  fiber  optic;  or,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  RED  signal  ground  wires  from  fortuitous  conductors  by  5  centimeters.  When  RED  signal 
ground  wires  run  parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortuitous  con¬ 
ductor  and  BLACK  wire  lines  or  BLACK  power  lines  run  parallel  for  30  meters  or  more,  increase  the 
separation  to  15  centimeters.  (See  paragraph  8.40.  for  more  information.) 

A14.4.20.  BLACK  Signal  Ground  Wire  and  BLACK  Equipment  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if:  (1)  the  line 
distance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary 
of  the  inspectable  space  is  more  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic;  and,  (2) 
BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load 
exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected,  separate  BLACK  signal 
ground  wires  from  BLACK  equipment  by  0.5  meters.  If  a  BLACK  wire  line  isolation  countermeasure 
is  used,  the  separation  distance  is  reduced  to  15  centimeters.  (See  paragraph  8.41.  for  more  informa¬ 
tion.) 

A14.4.21.  BLACK  Signal  Ground  Wire  and  BLACK  Wire  Line  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if  the  line  dis¬ 
tance  of  the  BLACK  wire  lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of 
the  inspectable  space  is  greater  than  2,000  meters  or  if  the  BLACK  lines  are  fiber  optic.  If  selected, 
separate  BLACK  signal  ground  wires  from  BLACK  wire  lines  by  5  centimeters.  When  a  BLACK  sig¬ 
nal  ground  wire  runs  parallel  to  a  BLACK  wire  line  for  30  meters  or  more,  increase  the  separation  to 
15  centimeters.  (See  paragraph  8.42.  for  more  information.) 

A14.4.22.  BLACK  Signal  Ground  Wire  and  BLACK  Power  Line  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected.  Do  not  select  this  countermeasure  if  (1)  BLACK 
power  lines  are  contained  within  the  inspectable  space  up  to  a  point  where  the  average  load  exceeds 
100,000  volt-amperes  and  at  least  10,000  volts  potential;  and,  (2)  the  line  distance  of  the  BLACK  wire 
lines  from  the  building  containing  the  RED  equipment  to  the  boundary  of  the  inspectable  space  is 
greater  than  1,000  meters  or  the  BLACK  lines  are  fiber  optic.  If  selected,  separate  BLACK  signal 
ground  wires  from  BLACK  power  lines  by  5  centimeters.  When  a  BLACK  signal  ground  wire  runs 
parallel  to  a  BLACK  power  line  for  30  meters  or  more,  increase  the  separation  to  15  centimeters.  (See 
paragraph  8.43.  for  more  information.) 

A14.4.23.  BLACK  Signal  Ground  Wire  and  Eortuitous  Conductor  Separation.  Consider  applying  this 
countermeasure  if  BLACK  signal  ground  is  selected  and  fortuitous  conductors  exit  the  inspectable 
space.  Do  not  select  this  countermeasure  if:  (1)  BLACK  wire  lines  from  the  building  containing  the 
RED  equipment  to  the  boundary  of  the  inspectable  space  is  more  than  250  meters  or  the  BLACK  lines 
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are  fiber  optic;  or,  (2)  BLACK  power  lines  are  contained  within  the  inspectable  space  up  to  a  point 
where  the  average  load  exceeds  100,000  volt-amperes  and  at  least  10,000  volts  potential.  If  selected, 
separate  BLACK  signal  ground  wires  from  fortuitous  conductors  by  5  centimeters.  When  BLACK 
signal  ground  wires  run  parallel  to  a  fortuitous  conductor  for  30  meters  or  more  and  the  same  fortu¬ 
itous  conductor  and  BLACK  wire  lines  or  BLACK  power  lines  run  parallel  for  30  meters  or  more, 
increase  the  separation  to  15  centimeters.  (See  paragraph  8.44.  for  more  information.) 

A14.4.24.  Administrative  Communications  Countermeasures.  Consider  applying  these  counter-mea¬ 
sures. 

A14.4.24.L  BLACK  Intercom  and  Public  Address  Systems.  If  selected,  use  paragraph  A12.2.2. 

(See  paragraph  8.53.  for  more  information.) 

A14.4.24.2.  Comfort  Music  Systems.  If  selected,  use  paragraph  A12.3.2.  (See  paragraph  8.55.  for 

more  information.) 

A14.4.24.3.  BLACK  Cable  TV  Systems.  If  selected,  use  paragraph  A12.4.2.  (See  paragraph  8.56. 

for  more  information.)  When  selected: 

A14.4.24.3.L  Separate  the  TV  set  from  RED  equipment  by  2  meters. 

A14.4.24.3.2.  Separate  video  cables  from  RED  equipment,  RED  wire  lines,  RED  power  lines, 
and  RED  signal  ground  wires  by  1  meter. 

A14.4.24.3.3.  Separate  active  splitters  or  amplifiers  from  RED  equipment,  RED  wire  lines, 
RED  power  lines,  and  RED  signal  ground  wires  by  1  meter. 

A14.4.24.4.  BEACK  TV-VCR  Systems.  If  selected,  use  paragraph  A12.5.2.  (See  paragraph  8.57. 

for  more  information.) 
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Attachment  15 

EXAMPLE  OF  EMISSION  SECURITY  REQUIREMENTS  MEMORANDUM 

A15.1.  Introduction.  This  attachment  provides  guidance  for  writing  a  memorandum  identifying  the 
required  EMSEC  precautions  and  the  lA  and  EMSEC  countermeasures. 

A15.2.  Memorandum  Format.  Use  the  standard  memorandum  format  with  the  lA  office’s  letterhead 

(see  Figure  A15.1.  and  Figure  A15.2.). 


166 


AFMAN33-214V2  21  SEPTMEBER  2001 


Figure  A15.1.  Sample  EMSEC  Requirements  Memorandum. 

(DATE) 

MEMORANDUM  FOR  (Address  to  the  User) 

FROM:  (The  lA  Office) 

SUBJECT ;  Required  EMSEC  Countermeasures 

1 .  This  memorandum  stipulates  the  information  assurance  and  EMSEC  countermeasures  required  for  the 
systems  identified  on  AF  Form  4 1 70,  Tracking  Number  {insert  tracking  number),  dated  {insert  date). 

The  AF  Form  4170  is  filed  at  {identify  the  location  by  organization,  office  symbol,  room  number,  s^e 
number,  and  the  file  designation). 

2.  Required  Communications  Systems  Precautions. 

a.  Do  not  use  cellular  telephones  within  10  meters  of  RED  equipment  until  contacting  the  lA  office. 
This  does  not  apply  to  short  term  visitors,  only  to  assigned  workers. 

b.  Do  not  use  cordless  telephones  within  10  meters  of  RED  equipment  until  contacting  the  lA  office. 

3.  Required  Information  Assurance  Countermeasures. 

a.  This  controlled  access  area  (CAA)  is  controlled  24/7,  and  has  true  floor-to-ceiling  walls;  therefore, 
RED  lines  may  be  run  beneath  raised  flooring  and  above  the  false  ceiling.  Check  them  for  tan^)ering 
twice  a  year  or  whenever  uncleared  personnel  have  had  access  to  them  (e  g.,  housekeeping,  painting,  CE 
work,  etc.). 

b.  Separate  RED  equipment  from  BLACK  wire  lines  by  0.5  meters.  This  separation  is  not  required 
for  fiber  optic  cables. 

c.  Do  not  let  telephone  instmments  touch  RED  equipment. 

d.  Make  sure  that  every  signal  line  from  a  RED  equipment  is  routed  only  to  another  RED  equipment 
or  is  encrypted  before  connection  to  a  BLACK  equipment. 

e.  Make  sure  all  RED  lines  remain  within  the  CAA  or  are  secured  before  leaving  the  CAA. 
f  Account  for  and  maintain  accountability  of  all  RED  lines. 

g.  Separate  RED  lines  from  BLACK  lines  by  a  distance  sufficient  to  easily  distinguish  RED  lines  from 
BLACK  lines. 

h.  Mark  all  RED  lines  with  a  1-inch  wide  strip  of  red  tape  or  red  paint  at  intervals  of  approximately  1- 
1/2  meters. 

i.  Control  BLACK  magnetic  media. 

(1)  Either; 

(a)  Separate  RED  equipment  from  any  BLACK  tape  players  or  recorders,  e.g.,  audio  (comfort 
music  system),  video  (television-video  cassette  recorder  system),  unclassified  data  recorders  or  playm, 
etc.),  by  10  meters,  and, 

(b)  Separate  any  RED  wire  lines,  RED  power  cords,  RED  signal  ground  wires,  and  BLACK 
signal  ground  wires,  2  meters  from  BLACK  wire  lines  and  BLACK  power  cords. 

(2)  Or,  magnetic  tapes  brought  in  and  played  will  not  leave  the  facility. 

(3)  Or,  degauss  the  magnetic  tapes  before  removal. _ 
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Figure  A15.2.  Sample  EMSEC  Requirements  Memorandum  (Continued). 

4.  Required  Information  Systems  Countermeasures. 

a.  Maintain  a  minimum  of  100  meters  of  inspectable  space. 

b.  Separate  RED  equipment  0.5  meters  from  BLACK  equipment. 

c.  Separate  RED  equipment  from  BLACK  wire  lines  by  1  meter. 

d.  Do  not  place  the  telephone  instrument  on  the  same  metal  desktop,  metal  bench  surface,  metal  shelf, 
or  metal  cabinet  top  as  the  RED  equipment. 

5.  Required  Communications  Systems  Countermeasures. 

a.  Separate  radio  base  station  10  meters  from  all  RED  equipment. 

b.  Do  not  power  RED  equipment  and  the  base  station  from  the  same  AC  power  circuit. 

6.  Required  Cryptographic  Countermeasures. 

a.  Use  the  manufacturer’s  supplied  cables  for  the  KIV-7. 

b.  A  rack  is  not  required  if  the  KIV-7  is  not  installed  in  a  computer. 

c.  Use  the  manufacturer’s  KIV-7  rack  if  rack  mounted. 

d.  Separate  modems  1  meter  from  RED  equipment.  Do  not  use  an  internal  modem. 

c.  There  are  no  separation  requirements  between  the  KIV-7  and  RED  or  BLACK  equipment. 

//SIGNED// 

(EMSEC  person) 

_ _ (Wing  lA  office) _ 
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Attachment  16 

EXAMPLE  OF  EMISSION  SECURITY  CERTIFICATION  MEMORANDUM 

A16.1.  Introduction.  This  attachment  provides  guidance  for  writing  a  memorandum  identifying  a  sys¬ 
tem  meets  EMSEC  certification  requirements  to  satisfy  the  C&A  process. 

A16.2.  Memorandum  Format.  Use  the  standard  memorandum  format  with  the  lA  office’s  letterhead 
(see  Figure  A16.1.). 

Figure  A16.1.  Sample  EMSEC  Certification  Memorandum. 

(Date) 

MEMORANDUM  FOR  (Address  to  the  User) 

FROM:  (The  lA  Office) 

SUBJECT:  EMSEC  Certification 

1 .  The  system  identified  as  {insert  the  description  as  contained  in  blocks  1  and  2  of  the  AF  Form  41 70), 
Tracking  Number  (insert  tracking  number),  (insert  certification  date)  is  certified  as  meeting  EMSEC 
requirements. 

2.  The  AF  Form  4170  supporting  this  memorandum  is  filed  at  (identify  the  location  by  organization, 
office  symbol,  room  number,  safe  number,  and  the  file  designation). 

//SIGNED// 

(EMSEC  person) 

EMSEC  Certifying  Official 

_ (Wing  lA  office) _ 
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Attachment  17 

EMISSION  SECURITY  TESTING 

AI7.I.  Emission  Security  Test  Request  Format.  Use  the  standard  memorandum  format.  The  subject  is 
"Request  for  EMSEC  Test."  The  memorandum  has  several  attachments.  The  most  important  attachment  is 
a  copy  of  the  EMSEC  countermeasures  review  (except  for  aircraft  test  requests).  Unless  otherwise  indi¬ 
cated,  provide  the  following  information  in  all  requests: 

A 17. 1.1.  Reason  for  Test.  Paragraph  7.3.  lists  the  reasons  for  requesting  an  EMSEC  test.  This  para¬ 
graph  of  the  request  should:  identify  one  or  more  of  those  basic  reasons,  include  additional  informa¬ 
tion  supporting  the  selection  of  the  reason  for  testing  as  justification  for  the  request,  and  include  a 
short  mission  statement. 

A17.1.2.  Need  Date.  Identify  the  desired  or  specified  date  for  the  test.  If  a  date  is  specified,  provide 
justification. 

AI7.I.3.  Processing  Procedures.  Include  a  simple  statement  as  to  whether  processing  classified  infor¬ 
mation  is  on  a  random  or  scheduled  basis. 

A 17. 1.4.  Points  of  Contact.  Identify  the  individual  to  contact  for  more  information  or  coordination  in 
processing  this  request  and  conducting  the  test.  Also  identify  the  wing  lA  office  point  of  contact.  Eor 
both,  include  rank,  name,  organization,  office  symbol,  and  telephone  numbers  (DSN,  commercial 
with  area  code,  and  STU  III). 

A17.I.5.  Security  Clearance.  What  security  clearance  level  and  special  accesses  are  required  for 
unescorted  access?  This  information  allows  the  test  team  to  acquire  the  necessary  clearances  to  reduce 
escort  requirements.  To  whom  are  security  clearances  sent?  What  briefing  arrangements  are  required 
when  test  team  members  are  briefed  for  special  accesses? 

AI7.2.  Facility  Test  Request.  In  addition  to  the  information  in  paragraphs  A 1 7. 1. 1,  through  A 1 7. 1. 5, 
provide  the  information  identified  below.  Omission  of  this  information  will  delay  your  request.  This  infor¬ 
mation  is  used  to  determine  the  need  and  scope  of  the  test. 

A17.2.1.  Facility  Identification.  Identify  the  building  and  extent  of  testing  (e.g.,  “Building  5,  Com¬ 
mand  Operations  Center,  Rooms  201,  202,  and  203.”). 

A17.2.2.  Eist  of  RED  Equipment.  Provide  a  list  of  RED  equipment  requiring  testing.  If  all  the  equip¬ 
ment  listed  on  the  EMSEC  countermeasures  review  needs  testing,  then  state  "See  EMSEC  counter¬ 
measures  review  equipment  list."  If  not  all  equipment  on  the  EMSEC  countermeasures  review  needs 
testing,  then  list  the  equipment  here.  Attach  the  list  if  it  is  too  long  for  the  main  body  of  the  letter.  In 
either  case,  identify  each  item  of  RED  equipment  requiring  testing  by  nomenclature,  manufacturer 
and  model  number. 

A17.2.3.  The  EMSEC  Countermeasures  Reviews.  A  copy  of  the  EMSEC  countermeasures  reviews  is 
required.  Make  sure  all  levels  of  classified  information  are  identified  and  the  volume  of  each  level. 
Make  sure  the  boundaries  of  the  inspectable  space  are  indicated.  If  the  CTTA  has  a  copy  of  the  coun¬ 
termeasures  reviews,  a  copy  is  not  needed;  identify  the  Tracking  Number. 

A17.2.4.  Physical  Control  Data.  Describe  access  control  measures  established.  Refer  to  and  use,  if 
desired,  the  same  drawings  used  in  the  EMSEC  countermeasures  review. 
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A17.2.5.  Site  Conditions.  Describe  the  type  of  installation. 

A17. 2.5.1.  Identify  whether  the  system  is  fixed,  mobile,  or  fixed-mobile  (e.g.,  a  van  used  in  a 
semipermanent  location).  Identify  type,  model,  and  series  of  van  used. 

A17.2.5.2.  Describe  the  location  in  terms  of  whether  the  installation  is  a  contractor  facility,  a 
civilian  facility,  open  military  installation,  closed  military  installation,  allied  military  installation, 
etc. 

A17.2.6.  Installation  Data.  Identify  who  installed  the  equipment  or  system  and  when.  Were  all  the 
required  countermeasures  installed?  Identify  all  deviations  and  waivers.  Include,  as  attachments, 
drawings  (preferably  single  sheet  8  1/2-inch  by  11-inch)  as  follows: 

A 1 7 . 2 . 6 . 1 .  The  Room  or  Rooms .  Include  dimensions . 


A17.2.6. 1 . 1 .  Show  the  location  of  both  RED  and  BLACK  equipment  positions. 

A17.2.6.1.2.  Show  the  location  of  all  telephones  within  the  room  or  rooms. 

A17.2.6.1.3.  Show,  as  closely  as  possible,  the  route  telephone  lines  follow  within  the  room  or 


rooms. 


A17.2.6.1.4.  Show  the  location  of  any  telephone  or  signal  wire  line  filters  within  the  room  or 


rooms. 


A17.2.6.1.5. 

A17.2.6.1.6. 

A17.2.6.1.7. 

A17.2.6.1.8. 


Show  the  location  of  all  fixed  transmitters  within  the  room  or  rooms. 

Show  the  location  of  any  power  transformers  within  the  room  or  rooms. 

Show  the  location  of  any  power  filters  within  the  room  or  rooms. 

Show,  as  closely  as  possible,  the  route  power  lines  follow  within  the  room  or 


rooms. 

A17.2.6.2.  The  Building.  Include  dimensions. 

A17.2.6.2.1.  Show  the  location  of  the  room  or  rooms  within  the  building. 

A17.2.6.2.2.  Show  the  floors  above  and  below  if  the  building  is  a  multistory  building.  Indi¬ 
cate  the  location  of  the  room  or  rooms. 


A17.2.6.2.3.  Identify  occupants  of  the  building  who  are  not  related  to  the  users  of  the  equip¬ 
ment  within  the  room  or  rooms,  e.g.,  contractors,  foreign  nationals,  other  Air  Force  units, 
organizations  from  other  agencies,  or  military  departments. 

A17.2.6.2.4.  Show  the  location  of  all  telephones  along  shared  walls  with  the  room  or  rooms. 

A17.2.6.2.5.  Show,  as  closely  as  possible,  the  route  telephone  lines  follow  along  shared  walls 
with  the  room  or  rooms. 


A17.2.6.2.6.  Show,  as  closely  as  possible,  the  route  telephone  lines  follow  in  rooms  directly 
below  the  room  or  rooms  if  the  telephone  lines  are  within  2  meters  of  the  ceiling. 

A17.2.6.2.7.  Show,  as  closely  as  possible,  the  route  telephone  lines  follow  in  rooms  directly 
above  the  room  or  rooms  if  the  telephone  lines  are  within  2  meters  of  the  floor. 

A17.2.6.2.8.  Show  the  location  of  any  telephone  or  signal  wire  line  filters  within  the  building. 

A17.2.6.2.9.  Show  the  location  of  all  fixed  transmitters  within  the  building. 
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A17.2.6.2.10.  Show  the  location  of  any  power  transformers  within  the  building. 

A17.2.6.2.11.  Show  the  location  of  any  power  filters  within  the  building. 

A17.2.6.2.12.  Show,  as  closely  as  possible,  the  route  power  lines  follow  along  shared  walls 
with  the  room  or  rooms. 

A17.2.6.3.  The  Installation.  Include  dimensions. 

A17.2.6.3.1.  Show  the  location  of  building  on  the  installation. 

A17.2.6.3.2.  Identify  occupants  of  other  buildings  located  within  100  meters  of  the  room  or 
rooms. 

A17.2.6.3.3.  Show  the  location  of  all  fixed  transmitters  within  the  buildings  within  100 
meters  of  the  room  or  rooms. 

A17.2.6.3.4.  Show  the  location  of  any  power  transformers  supplying  power  to  the  building. 

A17.2.6.3.5.  Show  the  location  of  any  power  filters  for  the  power  supplied  to  the  building  if 
not  located  within  the  building. 

A17.2.6.3.6.  Show,  as  closely  as  possible,  the  route  power  lines  follow  that  supply  power  to 
the  building  up  to  100  meters  from  the  building. 

A 17. 2. 7.  Data  Format.  Describe  in  this  paragraph  whether  the  data  is  all  numerical,  an  alpha-numeric 
mix,  or  alphanumeric  literal  text. 

A17.3.  Equipment  Laboratory  Test  Request.  In  addition  to  the  information  in  paragraphs  A17.1.1. 
through  A17.1.4.,  provide  the  information  identified  below.  Omission  of  this  information  will  delay  your 
request.  This  information  is  used  to  determine  the  need  for  the  test.  Also,  it  is  assumed  the  equipment  was 
not  installed. 

A17.3.1.  Equipment  Identification.  Identify  the  equipment  for  testing  by  nomenclature,  manufac¬ 
turer,  and  model  number. 

A17.3.2.  The  EMSEC  Countermeasures  Reviews.  A  copy  of  the  EMSEC  countermeasures  reviews  is 
required.  Make  sure  all  levels  of  classified  information  are  identified  and  the  volume  of  each  level.  If 
the  CTTA  has  a  copy  of  the  countermeasures  reviews,  a  copy  is  not  needed;  identify  the  Tracking 
Number. 

AI7.3.3.  Data  Eormat.  Describe  in  this  paragraph  whether  the  data  is  all  numerical,  an  alphanumeric 
mix,  or  alphanumeric  literal  text. 

A17.4.  Facility  Zone  Test  Request.  In  addition  to  the  information  in  paragraphs  A17.1.1.  through 
A17.1.5.,  provide  the  information  identified  below.  Omission  of  this  information  will  delay  your  request. 
The  information  is  used  to  determine  the  need  and  scope  of  the  test. 

A17.4.1.  Facility  Identification.  Identify  the  building  and  extent  of  testing,  for  instance.  Building  5, 
Command  Operations  Center,  Rooms  201,  202,  and  203. 

A17.4.2.  The  EMSEC  Countermeasures  Reviews.  A  copy  of  the  EMSEC  countermeasures  reviews  is 
required.  Make  sure  the  boundaries  of  the  inspectable  space  are  indicated.  If  the  CTTA  has  a  copy  of 
the  countermeasures  reviews,  a  copy  is  not  needed;  identify  the  Tracking  Number. 
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A17.4.3.  Physical  Control  Data.  Describe  aecess  control  measures  established.  Refer  to  and  use,  if 
desired,  the  same  drawings  used  in  the  EMSEC  countermeasures  review. 

A 17. 4. 4.  Site  Conditions.  Describe  the  facility. 

A17.4.4.1.  Describe  the  construction  of  the  facility;  all  brick  with  no  windows,  cinder  block  with 
large  windows,  wood  frame  with  wall  board  and  panel  siding,  single  story,  multistory  with  base¬ 
ment,  etc.  The  preferred  way  to  provide  this  information  is  by  drawings  showing  dimensions,  con¬ 
struction  materials  and  methods,  windows  with  type  and  size,  doorways  and  doors,  etc. 

A17.4.4.2.  Is  the  facility  located  on:  a  contractor’s  site,  a  civilian  location,  an  open  military  instal¬ 
lation,  a  closed  military  installation,  an  allied  military  installation,  etc.? 

A17.4.5.  Processing  Areas.  Identify  where  classified  information  is  processed  within  the  facility. 
Include,  as  attachments,  drawings  as  follows: 

A17.4.5.1.  The  building  showing  the  rooms  where  classified  information  is  processed.  Show 
dimensions. 

A17.4.5.2.  The  building  showing  the  area  for  zoning,  if  different  from  paragraph  A17.4.5.1. 
Show  dimensions. 

A17.4.5.3.  Identify  adjacent  occupants.  Give  significant  distances  between  adjacent  occupants 
and  where  classified  information  is  processed. 

A17.4.5.4.  Show  the  floors  above  and  below  if  the  building  is  multistoried.  Identify  occupants. 
Give  significant  distances. 

AI7.4.5.5.  The  portion  of  the  installation  showing  the  building.  Identify  occupants  of  buildings 
and  structures  within  100  meters. 

A17.4.5.6.  Show  all  fixed  transmitting  and  receiving  equipment. 

A17.5.  Equipment  Zone  Test  Request.  In  addition  to  the  information  in  paragraphs  A17.1.1.  through 
A17.1.4.,  provide  the  information  identified  in  paragraphs  A17.3.1.  through  A17.3.3.  Omission  of  this 
information  will  delay  your  request.  The  information  is  used  to  determine  the  need  for  the  test. 

A17.6.  Aircraft  Test  Request.  In  addition  to  the  information  in  paragraphs  A17.1.1.  through  A17.1.5., 
provide  the  information  identified  below.  Omission  of  this  information  will  delay  your  request.  The  infor¬ 
mation  is  used  to  determine  the  need  for  the  test. 

A17.6.1.  Aircraft  Identification.  Identify  the  aircraft  for  testing  by  type,  model,  and  series. 

A17.6.2.  Equipment  Identification.  Identify  the  equipment  for  testing  by  nomenclature,  manufacturer 
and  model  number. 

A17.6.3.  Transmitter  and  Receiver  Identification.  Identify  all  active  and  passive  transmitters  and 
receivers  installed  on  the  aircraft. 

A17.6.4.  Physical  Control  Data.  If  the  equipment  is  operated  while  the  aircraft  is  on  the  ground, 
describe  access  control  measures  established. 

A17.6.5.  Data  Eormat.  Describe  in  this  paragraph  whether  the  data  is  all  numerical,  an  alphanumeric 
mix,  or  alphanumeric  literal  text. 
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Attachment  18 
SHIELDED  CABLES 

A18.1.  Introduction.  This  attachment  describes  jacketed  multiconductor  twisted-pair  cable  consisting 
of  an  insulated,  shielded,  pair;  or  a  bundle  of  twisted  pairs  contained  in  a  single  shield.  It  provides  general 
guidance  for  usage  and  application  when  considering  the  overall  engineering  installation  process  for  a 
particular  system  or  facility. 

A18.2.  Physical  Cable  Characteristics. 

A  18.2.1.  A  cable  may  contain  any  number  of  individually  twisted  pairs. 

A1 8.2.2.  A  cable  may  contain  conductors  of  any  size. 

A18.2.3.  The  cable  is  shielded.  There  are  two  ways  to  shield  the  cable: 

A18.2.3.1.  Tinned  Copper  Braid.  The  cable  has  an  overall  shielding  of  85  to  90  percent  tinned 
copper-braid  coverage.  A  drain  wire  is  not  required  in  braided-copper  shielded  cable. 

A18. 2.3.2.  Foil  Wrapped.  This  form  of  shielded  cable  can  only  be  used  for  voice  signals  and  dig¬ 
ital  signals  below  5,000  bits  per  second.  The  foil  wraps  the  cable  in  an  overlapping  spiral.  The 
overlaps  must  be  z-locked.  The  cable  must  include  a  bare  drain  wire  that  has  a  lay  such  that  it  will 
make  electrical  contact  with  the  shield  throughout  its  length. 

A18.3.  Electrical  Cable  Characteristics. 

A1 8.3. 1 .  Do  not  use  the  shield  as  a  signal  return  path. 

A18.3.2.  Shielding  must  meet  the  following  requirements: 

A18.3.2.1.  100  dB  from  300  to  15,000  hertz. 

A18.3.2.2.  80  dB  over  the  baseband  video  range  up  to  5  MHz. 

A18.3.2.3.  60  dB  over  the  frequency  range  from  one  times  to  ten  times  the  basic  data  rate  of  the 
digital  signal. 

A 18. 3. 3.  Crosstalk  is  permitted  on  adjacent  pairs  within  a  bundle. 

A 18. 3. 4.  Achieve  effective  shielding  for  a  cable  by  terminating  the  cable  shield. 

A 1 8 . 3 . 4 . 1 .  Terminate  the  shield  at  both  ends . 

A18.3.4.2.  Do  not  use  long  pigtail  and  long  ground- wire  shield  terminations.  They  drastically 
reduce  shielding  effectiveness  and,  in  certain  frequency  ranges  (dependent  on  pigtail  length),  can 
completely  nullify  the  inherent  shielding  capability  of  a  cable. 

A1 8.3.4.3.  If  a  pigtail  is  the  only  method  of  shield  termination  used  in  a  particular  situation,  make 
the  pigtails  as  short  as  feasible  (one-half  centimeter  or  less),  and  bond  it  to  a  low-impedance  radio 
frequency  ground  such  as  a  ground  plate,  chassis,  or  wide  ground  bus.  A  long  slender  ground  wire 
is  not  an  effective  radio  frequency  ground  and  may  instead  become  an  antenna. 
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Attachment  19 
FILTERS  AND  ISOLATORS 

A19.1.  Introduction.  This  attachment  describes  the  application,  characteristics,  and  specifications  of  pas¬ 
sive  low-pass  signal  wire  line  filters,  active  low-pass  signal  wire  line  filters,  photon-coupled  (optical)  sig¬ 
nal  wire  line  isolators,  and  power  line  filters.  Figure  A19.1.  shows  the  attenuation  characteristics  of 
analog  signal  wire  line  filters  while  Table  A19.1.  shows  the  filter  ranges. 

A19.2.  Passive  Low-Pass  Signal  Wire  Line  Filters.  These  filters  are  relatively  inexpensive  and,  gener¬ 
ally,  perform  their  intended  function  well.  The  intent  of  these  filters  is  to  attenuate  by  a  specified  amount 
all  frequencies  above  a  specified  frequency. 

A19.2.1.  Filter  Design  Guidance.  For  the  most  effective  performance,  design  signal  wire  line  filters 
specifically  for  the  particular  application.  However,  using  an  existing  design  that  approximates  the 
desired  characteristics  is  more  economical  to  employ.  Generally  speaking,  there  are  two  types  of  sig¬ 
nals  that  require  filtering;  analog  signals  such  as  voice  or  the  tone  output  of  modems,  and  digital  sig¬ 
nals  that  are  in  the  form  of  square  waves.  Filter  behavior  and  performance  for  each  of  these  two  types 
of  signals  are  considerably  different. 

A19.2.2.  Analog  Signal  Wire  Line  Filters.  Normally,  analog  signal  wire  line  filters  are  designed  to 
match  a  balanced  600-ohm  signal  pair  (two  300-ohm  filters).  Curve  A  on  Figure  A19.1.  illustrates  the 
attenuation  characteristics  of  a  typical  filter  that  is  adequate  for  most  voice-grade  Western  Electric  201 
A/B  modems,  or  equivalent.  Filters  designed  to  give  attenuation  characteristics  of  curve  A  are 
expected  to  introduce  moderate  phase  and  amplitude  perturbation  in  the  1500  to  3300  hertz  portion  of 
the  passband,  even  when  used  in  an  impedance-matched  system.  If  there  is  an  impedance  mismatch  to 
the  filter,  these  perturbations  will  increase  in  proportion  to  the  extent  of  the  mismatch. 

A19.2.3.  Modems.  Modems  that  operate  at  bit  rates  up  to  9600  bits  per  second  (bps)  require  specially 
compensated  wire  line  facilities,  and  thus  can  tolerate  a  minimum  of  phase  and  amplitude  distortion 
introduced  by  signal  wire  line  filters.  For  applications  of  this  type,  filters  designed  to  curve  A  on  Fig¬ 
ure  A19.1.  are  not  suitable.  The  alternatives  are  to  design  an  expensive,  multielement,  compensated 
filter  with  cutoff  starting  as  indicated  in  curve  A;  or  employ  a  simple  filter  designed  with  attenuation 
characteristics  of  curve  B,  which  will  introduce  minimal  phase  and  amplitude  problems  in  the  fre¬ 
quency  band  of  the  modem;  0-3300  hertz.  Filtering  the  signal  lines  for  modems  operating  greater  than 
9600  bps  is  not  recommended  for  two  reasons.  First,  these  modems  require  specially  designed  filters 
reaching  100  dB  of  attenuation  within  a  decade  which  can  be  very  expensive.  Second,  modems  oper¬ 
ating  at  higher  frequencies  require  cutoff  frequencies  high  enough  to  allow  lower  frequency  compro¬ 
mising  emanations  to  escape.  To  meet  a  BLACK  line  isolation  requirement,  converting  the  signal 
lines  to  fiber  optic  is  preferred  above  9600  bps. 

A19.2.4.  Passive  Low-Pass  Inductive-Capacitive  Lilters.  Using  passive  low-pass  inductive-capaci¬ 
tive  filters  to  remove  undesired  frequency  components  from  digital  square-wave  signals  generates 
stringent  design  problems  because  of  the  tendency  of  inductive-capacitive  filters  to  "ring"  when  the 
input  signal  is  a  square-wave.  The  best  square-wave  performance  is  obtained  from  an  induc¬ 
tive-capacitive  filter  when  it  is  both  driven  and  terminated  with  its  characteristic  impedance;  however, 
there  is  some  ringing  apparent  and  there  is  a  6-dB  attenuation  of  the  signaling  voltage  (e.g.,  plus  or 
minus  6  volts  to  the  filter  driver  will  give  plus  or  minus  3  volts  out  to  the  line).  Since  this  degree  of 
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signal  attenuation  is  not  acceptable,  generally,  in  a  digital  system,  alternate  approaches  are  available 
that  provide  minimum  desired  signal  attenuation,  with  only  a  moderate  increase  in  ringing. 

A19.2.5.  Digital  Signal  Wire  Line  Filters.  Because  of  the  harmonic  content  of  digital  signals,  passive 
low -pass  inductive-capacitive  filters  have  limited  application  for  digital  signals.  Other  filter  solutions 
such  as  active  filters  or  photon-coupled  isolators  are  effective. 

A19.3.  Active  Low-Pass  Signal  Wire  Line  Filters.  These  filters  perform  the  same  function  as  passive 
filters,  only  better.  The  intent  of  these  filters  is  to  attenuate  by  a  specified  amount  all  frequencies  above  a 
specified  frequency.  This  class  of  filter  is  subdivided  into  three  categories:  isolators,  saturated  amplifiers, 
and  linear  amplifiers.  Active  filters  are  defined  as  frequency-selective  devices  that  employ  electronic 
impedance,  current,  and  voltage  modifying  elements,  requiring  the  application  of  power  for  the  utilization 
of  their  filtering  properties.  As  opposed  to  passive  filters,  active  filters  are  essentially  one-way  devices 
that  use  impedance  mismatch  as  the  primary  basis  for  filtering  action.  Note  also  that  the  phase  delay,  pass- 
band,  and  stop-band  characteristics  of  active  filters  vary  widely  from  those  of  standard  passive  filters.  On 
the  whole,  active  filters  are  more  readily  adapted  to  digital  applications;  however,  it  is  possible  to  design 
active  filters  to  process  analog  signals  with  a  minimum  of  distortion.  Active  filter  types  and  uses  are  as 
follows: 

A 19. 3.1.  Isolators.  The  common  characteristic  of  isolators  is  that  they  can  provide  DC  and  ground 
system  isolation  between  input  and  output  circuits,  thus  reducing  the  possibility  of  signal  conducting 
ground  loops.  Isolators  also  offer  design  possibilities  for  nonlow-level  signals  in  and  low-level  signals 
out,  or  vice  versa;  polar-to-neutral-to-polar  conversion;  and  independent  DC  levels  for  input  and  out¬ 
put  circuits.  To  obtain  these  characteristics,  separate  power  sources  are  necessary  for  input  and  output 
circuits.  Isolators  are  divided  into  the  following  functional  types:  magnetic-,  acoustic-,  and  pho¬ 
ton-coupled  isolators. 

A19.3.2.  Magnetic-Coupled  Isolators.  The  simplest  form  of  a  magnetic -coupled  isolator  is  a  conven¬ 
tional  electromechanical  relay.  Such  a  device  provides  DC  isolation,  but  is  limited  to  low  baud  rates 
and,  unless  it  is  a  very  special  shielded  design,  only  meager  higher  frequency  attenuation  is  obtain¬ 
able.  Another  form  of  magnetic-coupled  isolator  is  the  transformer-coupled  type  that  employs  a  mod¬ 
ulated  oscillator  in  the  input  side  that  operates  at  a  frequency  that  is  at  least  ten  times  the  highest  baud 
rate,  while  the  output  side  is  equipped  with  either  a  suitable  phase,  frequency  shift,  or  amplitude 
detector.  Effective  passive  filtering  of  the  input  and  output  signal  wire  lines  is  essential  to  prevent  the 
modulated  high  frequency  signal  from  coupling  out  of  the  isolator  onto  the  input  and  output  lines. 
Standard  relays  were  employed  as  isolators  in  teletype  systems  for  many  years;  however,  their  princi¬ 
pal  capability  is  DC  isolation  and  level  changing.  Transformer-coupled  isolators  are  not  highly  suc¬ 
cessful  as  digital  devices;  however,  as  analog  devices,  transformer  coupling  is  used  extensively  to 
provide  DC  isolation  between  equipment  and  balanced  input  and  output  lines. 

A19.3.3.  Acoustic-Coupled  Isolators.  Acoustic-coupled  isolators  are  somewhat  similar  to  trans¬ 
former-coupled  magnetic  isolators,  in  that  both  employ  a  modulated  oscillator  and  suitable  detecting 
devices.  In  the  acoustical  device,  the  oscillator  drives  a  transducer,  which  in  turn  excites  a  receive 
transducer  through  some  nonconducting  medium.  The  problems  encountered  with  this  type  of  isolator 
are  similar  to  those  of  the  magnetic-coupled  type.  In  general,  there  is  very  little  application  of  this  type 
device. 

A19.3.4.  Photon-Coupled  Isolators.  Photon-coupled  (optical)  isolators  are  available  in  many  different 
configurations.  These  range  from  integrated  circuit  components  (containing  both  a  light  source  and 
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detector  and  provide  only  DC  and  very  low  frequency  isolation)  to  isolators  that  employ  optical  cou¬ 
pling  through  a  waveguide  (capable  of  providing  more  than  120  dB  of  both  common-mode  and  trans- 
verse-mode  isolation  from  DC  through  10  Gigahertz  [GHz]).  Photon-coupled  isolators  are  available 
for  both  digital  and  analog  signal  applications  and  can  accept  digital  signaling  speeds  of  several  mil¬ 
lion  bps  and  analog  bandwidths  of  several  MHz.  Guidance  for  different  types  of  photon-coupled  opti¬ 
cal  signal-line  isolators  is  in  paragraph  A19.4. 

A19.3.5.  Saturated  Amplifiers.  This  type  of  active  filter  is  a  combination  of  saturated  input  and  out¬ 
put  amplifiers  coupled  together  by  means  of  a  single  resistive-capacitive  network.  If  an  active 
feedthrough  capacitor  between  the  input  and  the  output  compartments  and  an  independent  power  sup¬ 
ply  is  used  and  designed  into  the  enclosure,  attenuation  of  transverse-mode  unwanted  signals  of  at 
least  100  dB  is  possible.  Using  saturated  amplifiers  by  themselves  is  not  desirable  because  they  do  not 
provide  common-mode  isolation.  Using  an  optical  path  in  lieu  of  a  conducted  or  capacitive  penetra¬ 
tion  of  the  RED-to-BLACK  shield  adds  minimum  complexity  and  enhances  security.  See  paragraph 
A19.4.  for  a  discussion  of  photon-coupled  isolators  for  use  with  an  optical  path. 

A 19. 3. 6.  Active  Linear  Filters.  Active  linear  filters  are  normally  made  up  of  linear  amplifiers  that 
incorporate  frequency  selective  resistive-capacitive  networks  either  at  negative  feedback  elements  or 
in-line  filters  elements,  high-pass  or  band-injection  types.  In  general,  if  a  passive  filter  is  designed 
well,  it  will  provide  a  greater  degree  of  attenuation  of  unwanted  signals.  This  filter  would  cost  more 
but  the  small  size  and  versatile  characteristics  may  justify  the  added  cost.  Also,  active  filters  are  cur¬ 
rently  being  produced  in  chip-modular  form  that  offer  a  greater  variety  of  filtering  characteristics. 

A19.4.  Photon- Coupled  Isolators.  When  these  are  used  as  filters,  they  are  very  effective.  Although 
more  expensive  than  passive  or  active  filters,  sometimes  the  electrical  isolation  they  offer  is  needed.  Pho¬ 
ton-coupled  isolators  can  provide  more  than  120  dB  of  isolation  in  the  O-to-10  GHz  frequency  range  for 
lines  passing  through  any  equipment  or  equipment  area  interface  requiring  protection.  This  effectively 
prevents  a  conductive  or  capacitive  path  for  compromising  emanations  from  the  RED  equipment  area  to 
the  BLACK  equipment  area  and  the  uncontrolled  access  area.  Note  that  a  signal-line  filter  cannot  perform 
the  function  of  an  isolator,  because  a  conductive  path  is  always  present  within  the  passband  of  the  filter. 
Where  more  stringent  isolation  requirements  exist,  do  not  use  standard  signal-line  filters  because  ground 
current  loops  are  generated  due  to  the  low  impedance  to  ground  that  the  filter  inherently  has  at  frequencies 
above  its  cutoff  frequency.  These  ground  currents  present  the  possibility  of  passing  compromising  emana¬ 
tions  beyond  the  RED  equipment  area.  Analog  photon-coupled  signal-line  isolators  provide  attenuation  of 
the  unwanted  signals  equal  to  digital  isolation  in  the  "backward"  direction.  In  the  forward  direction,  they 
provide  common-mode  isolation  equal  to  digital  isolators,  but  do  not  provide  transverse-mode  isolation 
within  the  bandwidth  of  the  signal  being  transmitted.  The  analog  photon-coupled  signal-line  isolator  is 
equal  to  the  best  active  or  passive  filters.  A  photon-coupled  signal-line  isolator  allows  shielding  the  input 
and  output  modules  by  a  ground  plane  connected  only  by  a  nonconductive  optical  path  through  a 
waveguide-beyond-cutoff  penetration.  A  ground  plane  is  a  shielded  room  wall,  a  conduit  box,  the  equip¬ 
ment  housing,  or  other  container.  This  arrangement  assures  a  high  level  of  signal  isolation  at  all  speeds. 

A19.4.1.  Common-Mode  Signal  Isolation.  Common-mode  signal  isolation  is  defined  as  the  degree  of 
signal  attenuation  in  dB  between  the  shorted  input  and  the  shorted  output  of  the  isolation  device  when 
the  signal  source  is  between  the  shorted  input  of  the  isolation  device  and  ground  reference.  Connect 
the  measuring  equipment  between  the  shorted  output  and  the  same  ground  reference.  This  definition 
applies  to  both  forward  and  backward  (output-to-input)  isolation. 
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A19.4.2.  Advantages  of  Photon-Coupled  Isolators.  The  advantages  of  using  photon-coupled  isolators 
are:  (1)  eliminates  the  electrically  conductive  path  of  undesired  signals  between  the  input  and  output 
modules;  (2)  attenuates  the  common-mode  signals  by  use  of  waveguides  operating  below  cut-off  as 
attenuators;  and  (3)  eliminates  undesired  transverse-mode  signals  by  filtering,  pulse  reshaping,  or 
pulse  regeneration.  Mount  the  isolators  inside  a  radio  frequency  interference  (RFI)  cabinet  or  on  the 
wall  of  a  shielded  room.  Penetrate  the  shield  in  the  form  of  a  waveguide  tube  through  which  the  optic 
path  passes.  Choose  the  dimensions  of  the  waveguide  tube  to  prevent  passing  radio  frequency  energy 
below  10  GHz. 

A19.4.3.  Waveguide  Attenuation  Calculations.  A  waveguide  of  proper  dimensions  acts  as  an  attenu¬ 
ator.  Calculate  the  attenuation  of  a  length  of  waveguide  below  its  cutoff  frequency  using  the  following 
formula  for  circular  waveguides:  Attenuation  (dB)  =  32  X  L/D  where  L  is  the  length  of  the  waveguide 
and  D  is  the  inside  diameter.  For  rectangular  waveguides,  the  number  32  becomes  27.3  and  D 
becomes  the  dimension  of  the  rectangular  cross  section.  Thus,  a  waveguide  using  a  6-to-l  ratio  of 
length-to-diameter  will  have  an  attenuation  of  192  dB.  The  waveguide  becomes  an  attenuator  when 
the  diameter  becomes  small  in  relation  to  a  half-wavelength  of  the  electromagnetic  energy.  A 
waveguide  with  a  1/4-inch  inside  diameter  starts  to  cut  off  at  approximately  4  GHz  and  is  90  percent 
cut  off  at  10  GHz. 

A19.4.4.  Power  Required.  Power  photon-coupled  signal  isolators  with  two  appropriate  DC  power 
supplies;  one  for  the  BLACK-side  module,  and  one  for  the  RED-side  module.  The  mounting  configu¬ 
ration  is  dependent  on  the  number  of  lines  isolated,  the  types  of  isolators  chosen,  and  the  condition  of 
the  area  or  system  needing  treatment.  Various  housing  and  penetration  hardware  configurations  are 
available.  Some  isolators  operate  by  power  derived  from  line-loop  current. 

A19.4.5.  Optical  Isolator  Specifications.  Optical  isolators  are  now  available  for  audio,  video,  wide¬ 
band,  radio  frequency,  T-carrier,  analog,  and  digital  applications.  Identify  your  input  signal,  speed, 
bandwidth,  output  signal,  isolation,  and  distortion  requirements. 

A19.4.6.  EMSEC  Considerations.  Because  optical  isolators  usually  handle  BEACK  signals,  EMSEC 
is  not  normally  a  problem  within  the  isolators.  However,  in  some  applications,  isolators  are  used  with 
RED  signals;  indicate  that  fact.  Certain  isolators  are  designed  for  RED  applications,  and  their  circuits 
are  designed  to  prevent  the  generation  of  signals  that  will  cause  EMSEC  problems. 

A19.5.  Power  Line  Filters.  These  filters  are  identical  in  electrical  characteristics  to  low-pass  filters  but 
manufactured  more  robustly  to  handle  the  power.  They  are  intended  to  attenuate  by  a  specified  amount  all 
frequencies  above  a  specified  frequency. 

A19.5.1.  Introduction.  This  section  covers  the  general  characteristics  of  power  line  filters  that  are 
commonly  used  for  either  equipment  or  bulk  filtering.  The  information  below  is  general  guidance  for 
usage  and  applications  when  considering  the  overall  engineering  installation  applications  for  a  partic¬ 
ular  system  or  facility. 

A19.5.2.  Eimiting  Characteristics.  Do  not  consider  power  line  filters  as  an  assured  method  of  ade¬ 
quately  suppressing  compromising  emanations  because  of  the  reasons  discussed  below.  The  custom 
design  of  power  line  filters  for  each  equipment  where  the  need  exists  is  preferred.  It  is  easier  to  attain 
the  required  insertion  loss  with  equipment  filters  because  saturating  inductors  is  a  lesser  problem  due 
to  lower  current  and  because  impedance  mismatch  is  minimized  due  to  known  characteristics. 
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A19.5.3.  As-Installed  Performance.  The  as-installed  stop-band  attenuation  of  power  line  filters  is 
often  much  less  than  manufacturers’  specifications  or  attenuation  measured  in  a  test  jig.  Several  fac¬ 
tors  influence  the  as-installed  performance.  These  include  the: 

A19.5.3.1.  Radio  frequency  impedance  of  the  grounding  system. 

A19.5.3.2.  Presence  of  RED  signal  contamination  on  the  grounding  system. 

A19.5.3.3.  Isolation  provided  by  the  filter  mounting  scheme  and  external  wiring. 

A19.5.3.4.  Influence  of  the  filter  design  with  respect  to  inducing  RED  signal  currents  on  the 
grounding  system.  (A  filter  with  an  inductive  input  usually  will  induce  much  less  signal  current 
into  the  ground  system  than  a  filter  with  a  capacitive  input.) 


Figure  A19.1.  Attenuation  Characteristics  of  Analog  Signal  Wire  Line  Filters. 
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Table  A19.1.  Filter  Ranges. 


Curve  A 

up  to  1,000  bps  (500  square  wave  hertz/second  (Hz/s)) 

Curve  B 

up  to  3,000  bps  (1,500  square  wave  Hz/s) 

Curve  C 

up  to  10  kilobits  per  second  (kbps)  (5,000  square  wave  Hz/s) 

Curve  D 

up  to  30  kbps  (15,000  square  wave  Hz/s) 
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Attachment  20 

MAINTENANCE  OF  SHIELDED  ENCLOSURES 

A20.I.  Introduction.  This  attachment  provides  guidance  for  properly  maintaining  shielded  enclosures. 
Test,  inspect,  and  maintain  enclosures  periodically  during  operational  use. 

A20.2.  Inspections.  The  frequency  of  inspections  depends  on  the  extent  of  its  use.  Following  is  a  sug¬ 
gested  inspection  schedule  for  enclosures:  perform  maintenance  as  required. 

A20.2.1.  Daily.  Doors  with  finger  stock  used  more  than  ten  times  a  day. 

A20.2.2.  Weekly.  Doors  with  finger  stock  used  less  than  ten  times  a  day. 

A20.2.3.  Monthly.  Doors  not  using  finger  stock,  filters,  air  ducts,  and  motor  generator  (if  used). 

A20.2.4.  Annually.  Joints,  panels,  and  roof  (include  leakage  tests). 

A20.2.5.  Every  3  Years.  Conduct  a  shielding  effectiveness  test  as  part  of  the  facility  recertification 
according  to  paragraph  8.51.5.6. 

A20.3.  Door  and  Frame  Maintenance. 

A20.3.1.  Cleaning.  Clean  the  contact  surfaces  of  the  door  and  frame  with  steel  wool  to  remove  all 
traces  of  corrosion,  floor  wax,  or  other  nonconducting  material.  Take  care  to  avoid  deforming  the  fin¬ 
ger  stock. 

A20.3.2.  Finger  Stock.  Bent  or  deformed  finger  stock  is  restored  to  its  original  shape  with  a 
wide -blade  screwdriver,  flat  piece  of  rigid  metal,  or  long-nose  pliers.  Take  care  to  avoid  deforming 
fingers  adjacent  to  those  being  adjusted.  Cut  away  broken  fingers  from  the  door  with  sheet  metal 
shears.  Replacements  are  then  soldered  into  place. 

A20.3.3.  Latch  and  Lock. 

A20.3.3.1.  Adjust  the  position  of  the  striker  plate  if  the  door  is  difficult  to  close  and  the  striker 
plate  or  latch  shows  excessive  wear. 

A20.3.3.2.  Replace  the  knit-metal  gasket  around  the  shaft  if  the  enclosure  door  has  a  built-in  lock 
and  if  radio  frequency  checks  reveal  leakage  around  it. 

A20.3.3.3.  Notify  the  enclosure  manufacturer  if  the  door  is  not  repairable  by  the  techniques 
described  above. 

A20.3.4.  Scored  Door  Frame.  Attaching  brass  plates  to  the  face  of  the  doorframe  prevents  deep  dents 
in  the  doorframe  caused  by  attempts  to  close  the  door  with  the  latches  protruding.  Dents  on  the  contact 
surface  are  filled  with  solder  and  sanded  flat. 

A20.3.5.  Sagging  Door.  If  the  door  scrapes  its  frame  during  normal  operation,  or  if  the  depth  of  the 
contact  pattern  is  irregular,  the  door  is  sagging.  If  the  hinges  are  intact,  the  door  position  is  adjusted  by 
loosening  the  hinge  screws,  shifting  the  door  to  its  proper  position,  and  retightening  the  screws.  If  the 
hinges  are  badly  worn,  replace  with  steel  hinges. 

A20.3.6.  Acoustic  Seal.  A  worn  or  broken  acoustic  gasket,  misalignment  of  the  door,  or  unintentional 
metal-to-metal  contact  between  the  door  and  its  frame  may  cause  acoustic  leakage  around  the  door. 
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Design  details  of  acoustic  seals  vary  with  the  manufacturer,  but  they  generally  include  adjustable 
framing  strips  and  rubber  gaskets.  Remove  worn,  flattened,  or  torn  gaskets  and  glue  replacements  to 
the  door.  Adjust  framing  strips  only  as  a  last  resort,  since  alignment  is  critical. 

A20.4.  Air  Duct  Cleaning.  Frequent  cleaning  or  replacement  of  the  air  filter  in  the  air  conditioner  pre¬ 
vents  clogging  of  the  waveguide  air  vents.  If  these  vents  require  cleaning,  use  a  vacuum  cleaner  and  an 
aerosol  grease  solvent.  Do  not  remove  the  vents  from  the  shield  since  reinstallation  with  a  good  radio  fre¬ 
quency  joint  is  difficult. 

A20.5.  Repair  of  Acoustic  Ducts.  Acoustic  leakage  from  these  ducts  is  usually  caused  by  unintentional 
contact  between  metal  ductwork  and  the  radio  frequency  shield  or  by  sagging  ducts  that  compress  the 
acoustic  gaskets.  Holes  or  worn  spots,  particularly  in  the  nonmetallic  parts,  also  cause  leaks.  Repair  tech¬ 
niques  are  usually  self-evident. 

A20.6.  Major  Structural  Repairs.  Tighten,  with  a  torque  wrench,  loose  joints  in  bolted  enclosures 
detected  during  radio  frequency  leakage  tests.  For  inside  bolted  enclosures,  this  requires  removing  all 
interior  materials  that  cover  the  leaking  joint.  If  these  include  acoustic  materials,  reinstall  carefully  to  pre¬ 
vent  subsequent  acoustic  leakage.  The  enclosure  manufacturer  repairs  major  structural  failures,  such  as  a 
sagging  roof,  warped  panels,  or  deformed  floor.  Replace  or  patch,  if  appropriate,  torn  foil  panels.  If  a  tear 
occurs  in  a  panel  covering  plywood  or  other  solid  surface,  apply  a  patch  by  using  a  conductive  adhesive 
mastic  around  the  tear  and  placing  a  patch  of  foil  that  covers  the  hole  or  tear  completely  and  extends 
beyond  it  by  at  least  four  inches.  When  a  tear  occurs  between  studs  or  fir  strips,  replace  the  panel  or  place 
an  additional  foil  panel  on  top  of  the  torn  section  making  a  third  layer  of  the  particular  section. 
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Attachment  21 

APPLYING  ADMINISTRATIVE  COMMUNICATIONS  COUNTERMEASURES 

A21.1.  Introduction.  Do  not  apply  these  countermeasures  unless  the  EMSEC  countermeasures  review 
using  one  of  the  Attachment  6  through  Attachment  14  directs  you  into  this  attachment.  This  attachment 
provides  commonly  required  administrative  communications  countermeasures.  Due  to  the  amount  of 
information  and  the  number  of  times  they  are  required,  they  were  placed  in  this  attachment  to  conserve 
space. 

A21.2.  BLACK  Intercom  and  Public  Address  Systems. 

A2 1.2.1.  Required  Application.  Do  the  following  when  application  of  this  countermeasure  is 
required. 

A2 1.2. 1.1.  A  wireless  intercom  system  (radio  frequency  transmitter)  is  prohibited  in  all  cases. 

A2 1.2. 1.2.  Contain  the  system  totally  within  the  inspectable  space. 

A2 1.2. 1.3.  Install  the  public  address  amplifier  in  a  metal  cabinet  to  contain  any  free-space  radia¬ 
tion  it  might  generate. 

A2 1.2. 1.4.  Separate  wire  lines  according  to  the  separation  requirements  in  the  appropriate  coun¬ 
termeasures  review  attachment. 

A21.2.2.  Selected  for  Application.  Do  the  following  when  this  countermeasure  has  been  considered 
and  selected  for  application. 

A21.2.2.1.  A  wireless  intercom  system  (radio  frequency  transmitter)  is  prohibited  in  all  cases. 
A21.2.2.2.  Contain  the  system  totally  within  the  inspectable  space. 

A21 .2.2.3.  Separate  wire  lines  according  to  the  separation  requirements  in  the  applicable  counter¬ 
measures  review  attachment. 

A21.3.  Comfort  Music  Systems.  There  are  two  types  of  comfort  music  systems— those  that  use  a  radio 
receiver  and  those  that  do  not.  Take  the  following  precautions  to  reduce  the  risk  of  the  system  becoming 
an  escape  medium  for  compromising  emanations.  Systems  that  do  not  use  a  radio  receiver  include  sys¬ 
tems  like  compact  disk  (CD)  or  play-only  tape  players. 

A2 1.3.1.  Required  Application.  Do  the  following  when  application  of  this  countermeasure  is 
required. 

A2 1.3. 1.1.  Contain  the  entire  music  system,  including  speakers  and  associated  cables,  within  the 
inspectable  space.  The  user  may  need  two  music  systems  at  some  locations,  one  for  within  the 
inspectable  space  and  one  for  outside  the  inspectable  space. 

A21.3.1.2.  Use  shielded  audio  cable,  as  described  in  Attachment  18,  between  the  receiver  and 
speakers.  Separate  according  to  the  requirements  established  for  shielded  wire  lines  in  the  applica¬ 
ble  countermeasures  review  attachment. 

A21.3.1.3.  Use  "open  type"  speakers  (that  is,  ceiling  mount  or  open  box)  for  easy  inspection. 
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A21.3.1.4.  Operate  the  system  (play  musie)  whenever  elassified  information  is  proeessed.  This 
prevents  the  speakers  from  becoming  microphones. 

A2 1.3. 1.5.  Separate  the  BLACK  power  line  (power  cord)  from  RED  equipment,  RED  wire  lines, 
and  RED  power  (if  required)  according  to  the  separation  requirements  in  the  applicable  counter¬ 
measures  review  attachment. 

A2 1.3. 1.6.  Separate  the  tape  player  from  RED  equipment  by  the  distance  specified  in  the  applica¬ 
ble  countermeasures  review  attachment,  or  audio  tapes  brought  in  and  played  may  not  leave  the 
facility  or  degauss  the  tapes  before  removal.  There  are  no  separation  or  control  requirements  for 
CD  players.  The  decision  to  allow  tapes  into  the  facility  is  made  by  the  security  manager  for  the 
facility. 

A21.3.1.7.  Eor  systems  using  a  radio  receiver,  separate  the  receiver  from  RED  equipment  by  1 
meter.  When  this  separation  requirement  is  not  met,  install  the  receiver  inside  a  metal  cabinet, 
such  as  wall  locker  or  storage  cabinet,  to  reduce  the  possibility  of  radiated  compromising  emana¬ 
tions  coupling  onto  the  receiver.  Keep  the  doors  shut. 

A21.3.2.  Selected  Eor  Application.  Do  the  following  when  this  countermeasure  has  been  considered 
and  selected  for  application. 

A21.3.2.1.  Contain  the  entire  music  system,  including  speakers  and  associated  cables,  within  the 
inspectable  space.  The  user  may  need  two  music  systems  at  some  locations,  one  for  within  the 
inspectable  space  and  one  for  outside  the  inspectable  space. 

A21.3.2.2.  Separate  wire  lines  according  to  the  requirements  established  in  the  applicable  coun¬ 
termeasures  review  attachment. 

A21.3.2.3.  Separate  the  tape  player  from  RED  equipment  by  the  distance  specified  in  the  applica¬ 
ble  countermeasures  review  attachment  or  audio  tapes  brought  in  and  played  may  not  leave  the 
facility  or  degauss  the  tapes  before  removal.  There  are  no  separation  or  control  requirements  for 
CD  players.  The  decision  to  allow  tapes  into  the  facility  is  made  by  the  security  manager  for  the 
facility. 

A21.3.2.4.  Eor  systems  using  a  radio  receiver,  separate  the  receiver  from  RED  equipment  by  1 
meter.  When  this  separation  requirement  is  not  met,  install  the  receiver  inside  a  metal  cabinet, 
such  as  wall  locker  or  storage  cabinet,  to  reduce  the  possibility  of  radiated  compromising  emana¬ 
tions  coupling  onto  the  receiver.  Keep  the  doors  shut. 

A21.4.  BLACK  Cable  Television  Systems. 

A2 1.4.1.  Required  Application.  Do  the  following  when  application  of  this  countermeasure  is 
required. 

A2 1 .4. 1 . 1 .  Separate  the  TV  set  from  RED  equipment  according  to  the  requirements  established  in 
the  applicable  countermeasures  review  attachment. 

A2 1.4. 1.2.  Install  the  entire  video  cable  distribution  system  in  emt  conduit.  Do  not  expose  more 
than  0.5  meters  of  the  video  cable  behind  the  TV  receiver  or  at  the  distribution  splitter  or  amplifier. 
An  alternative  is  to  use  shielded  video  cable  meeting  the  requirements  in  Attachment  18.  Connect 
the  shield  to  BEACK  signal  ground,  where  available. 
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A2 1.4. 1.3.  Separate  video  eables  by  the  distanee  specified  in  the  applicable  countermeasures 
review  attachment. 

A2 1.4. 1.4.  Separate  the  BLACK  power  line  (power  cord)  from  RED  equipment,  RED  wire  lines, 
and  RED  power  (if  required)  according  to  the  separation  requirements  in  the  applicable  counter¬ 
measures  review  attachment. 

A21.4.1.5.  Isolate  the  video  cable.  This  is  best  done  at  the  boundary  of  the  inspectable  space  to 
preclude  the  video  cable  from  becoming  recontaminated  with  compromising  emanations.  This  is 
not  always  practical  but  isolation  must  be  done  beyond  the  ERTZ  or  the  cable  must  be  shielded  or 
installed  in  emt  conduit.  There  are  three  generally  acceptable  methods  for  isolating  the  cable. 

A2 1.4. 1.5.1.  Method  One.  Use  a  photon-coupled  (optical)  isolator,  as  described  in  Attach¬ 
ment  19,  to  break  the  electrical  connection  for  conducted  emanations  and  to  filter  out  any 
emanations  that  may  have  modulated  the  TV  receiver. 

A21.4. 1.5.2.  Method  Two.  Use  a  combination  of  attenuation  and  amplification  to  reduce  both 
conducted  and  modulated  emanations.  Use  a  combination  of  the  front-to-back  ratio  of  the 
amplifier  and  additional  attenuation  (for  example,  using  an  amplifier  with  a  70-dB 
front-to-back  ratio  and  a  30-dB  attenuator  will  provide  the  required  100  dB  of  isolation).  Set 
the  gain  of  the  amplifier  for  optimal  operation,  usually  unity  gain  (enough  to  overcome  the 
decrease  in  signal  level  caused  by  the  attenuator).  The  minimum  acceptable  attenuation  is  100 
dB.  Do  not  use  an  amplifier  that  can  amplify  signals  in  both  directions. 

A21.4.1.5.3.  Method  Three.  Eor  a  single  TV  receiver,  a  VCR  can  provide  the  video  service 
and  will  also  act  as  a  “one  way”  filter.  If  a  control  box  is  used,  collocate  it  with  the  VCR.  Dis¬ 
connect  the  incoming  video  cable  before  using  the  VCR  for  processing  classified  information. 

A2 1.4. 1.6.  If  using  an  active  cable  splitter  or  amplifier  to  distribute  the  video  signal  within  the 
facility,  separate  the  splitter  or  amplifier  by  the  distance  specified  in  the  applicable  countermea¬ 
sures  review  attachment  from  RED  equipment.  If  this  separation  requirement  is  not  met,  install  the 
splitter  or  amplifier  inside  a  metal  container  or  cabinet,  such  as  wall  locker  or  storage  cabinet,  to 
reduce  the  possibility  of  radiated  compromising  emanations  coupling  onto  the  splitter  or  amplifier. 
Shield  the  incoming  lines  to  a  distance  of  at  least  one-third  the  ERTZ  of  the  RED  equipment. 

A21.4.2.  Selected  for  Application.  Do  the  following  when  this  countermeasure  has  been  considered 
and  selected  for  application. 

A2 1 .4.2. 1 .  Separate  the  TV  set  from  RED  equipment  according  to  the  requirements  established  in 
the  applicable  countermeasures  review  attachment. 

A21.4.2.2.  Separate  video  cables  by  the  distance  specified  in  the  applicable  countermeasures 
review  attachment. 

A21.4.2.3.  Separate  the  BEACK  power  line  (power  cord)  from  RED  equipment,  RED  wire  lines, 
and  RED  power  (if  required)  according  to  the  separation  requirements  in  the  applicable  counter¬ 
measures  review  attachment. 

A21.4.2.4.  If  using  an  active  cable  splitter  or  amplifier  to  distribute  the  video  signal  within  the 
facility,  separate  the  splitter  or  amplifier  by  the  distance  specified  in  the  applicable  countermea¬ 
sures  review  attachment  from  RED  equipment. 
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A21.5.  BLACK  Television- Video  Cassette  Recorder  Systems. 

A2 1.5.1.  Required  Application.  Do  the  following  when  application  of  this  countermeasure  is 
required. 

A21.5.1.1.  Contain  the  TV-VCR  system,  including  speakers  and  associated  cables,  within  the 
inspectable  space.  The  user  may  need  two  TV-VCR  systems  at  some  locations,  one  for  within  the 
inspectable  space  and  one  for  outside  the  inspectable  space. 

A21.5.1.2.  Separate  the  TV-VCR  system  from  RED  equipment  by  the  distance  specified  in  the 
applicable  countermeasures  review  attachment  or  video  tapes  brought  in  and  played  may  not  leave 
the  facility  or  degauss  the  tapes  before  removal.  The  decision  to  allow  tapes  into  the  facility  is 
made  by  the  security  manager  for  the  facility. 

A2 1.5. 1.3.  Separate  video  cables  (BLACK  wire  lines)  by  the  distance  specified  in  the  applicable 
countermeasures  review  attachment. 

A2 1.5. 1.4.  Separate  the  BLACK  power  line  (power  cord)  from  RED  equipment,  RED  wire  lines, 
and  RED  power  (if  required)  according  to  the  separation  requirements  in  the  applicable  counter¬ 
measures  review  attachment. 

A21.5.2.  Selected  Eor  Application.  Do  the  following  when  this  countermeasure  has  been  considered 
and  selected  for  application. 

A21.5.2.1.  Contain  the  TV-VCR  system,  including  speakers  and  associated  cables,  within  the 
inspectable  space.  The  user  may  need  two  TV-VCR  systems  at  some  locations,  one  for  within  the 
inspectable  space  and  one  for  outside  the  inspectable  space. 

A21.5.2.2.  Separate  video  cables  (BLACK  wire  lines)  by  the  distance  specified  in  the  applicable 
countermeasures  review  attachment. 

A21.5.2.3.  Separate  the  BLACK  power  line  (power  cord)  from  RED  equipment,  RED  wire  lines, 
and  RED  power  (if  required)  according  to  the  separation  requirements  in  the  applicable  counter¬ 
measures  review  attachment. 
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Attachment  22 

AIR  FORCE  FORM  4170,  EMISSION  SECURITY  ASSESSMENTS 
A22.1.  Figure  A22.1.,  Figure  A22.2.,  and  Figure  A22.3.  are  samples  of  a  completed  AF  Form  4170. 
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Figure  A22.1.  AF  Form  4170,  Emission  Security  Assessments  (Page  1). 


PART  I  (U!  EMISSION  SECURITY  ASSESSMENTS 


1.  iV!  EOUVMENT: 

One  PC  with  exiemtl  removable  hard  drive  and  a  laser  printer 


2.  tXA  LOCATION: 

HQ  AFCA/OCI.  Bldg.  1700,  Room  2040,  Scott  AFB  IL 


3.  t\Ji  EMISSION  SECURITY  ASSESSMENT  SUMMARY: 


lEmSl 


CLASSrCOBY:  OINNSA  ^TA/5S> 

OCCLASSrv  :  TEN  YEARS  FROM  DATE  OF  CLASSriCATK>N 


CLASSIFICATION  LEVELt 


an  UNCLASSIFIED 


an  CONROENTIAL 


(in  SECRET 


an  TOP  SECRET 


4.  tu)  EM»SIONSECURrTY  ASSESSMENT  RESULTS. 


A.  an  MFORMATION  SYSTEMS: 


(Ct  COUNTERMEASURES  NOT  REQUIREO. 


an  VOLUME: 


UNCLASSIFIED 


(V)  CONFIDENTIAL 


(Ut  TOP  SECRET 


an  COMMUNICATIONS  SYSTEMS: 


to  COUNTERMEASURES  NOT 
REQUAED 


C.  an  OCOQRAPHIC  LOCATION: 


an  WITHM  USAP 


id  OUTSOE  USSR.  LOW  THREAT 


<0  OUTSCC  USSR.  MEDIUM  THREAT 


lOOUTSDC  USSR,  HIGH  THREAT 


C.  m  CRYPTOORAPHIC  EQUIPMENT: 


an  COUNTERMEASURES  NOT  REQUAEO 


(O  COUNTERMEASURES  REQUIREO 


an  COUNTERMEASURES  REQUIREO 


to  COUNTERMEASURES  REQUIRED 


_ PART  II  (U)  EMISSION  SECURITY  COUNTERMEASURES  REVIEWS 

6.  m  R£QU(flEMENT«: 

1.  (U)  COMMUNICATIONS  SYSTEMS  PRECAUTIONS. 

1.1.  (U)  Do  not  uw  oellular  telephooet  within  10  meters  of  RED  equipment  until  contacting  the  lA  office.  This  does  not  apply 
to  short  term  visitors,  only  to  assigned  woricers  (AFMAN  33-214,  Volume  1,  paragraph  3.8). 

1.2.  (U)  Do  not  use  cordless  telephones  within  10  meters  of  RED  equipment  until  contacting  the  lA  office  (AFMAN  33-214. 
Volume  I,  paragraph  3.8.). 

2.  (U)  INFORMATION  ASSURANCE  COUNTERMEASURES. 

2.1.  (U)  Thia  CAA  is  controlled  24/7,  and  has  true  floor-to-ceiling  walls,  therefore  RED  signal  lines  may  be  run  beneath  raised 
fkxmng  and  above  the  false  ceiling.  Chech  them  for  tampering  twice  a  year  or  whenever  uncleared  personnel  have  had  access  to 
them  (housekeeping,  painting,  CE  work,  etc.).  (AFMAN  33-214,  Volume  1,  Paragraph  5.3. 1.3) 

2.3.  (U)  Do  not  let  telephone  instruments  touch  RED  equipment.  (AFMAN  33-214,  Volume  1,  paragraph  5.3. 2.2.). 

2.4.  (U)  Make  sure  that  every  signal  line  form  RED  equipment  is  routed  only  to  other  RED  equipment  and  is  encrypted  before 
connecting  to  BLACK  equipment.  (AFMAN  33-214,  Volume  I,  paragraph  5.3.3.). 

2.5.  (U)  Make  sure  all  RED  signal  lines  remain  within  the  CAA  or  are  secured  before  leaving  the  CAA.  Secure  them  by  using 
(listed  by  preference)  cryptographic  equipment,  intrusion  detection  optical  carrier  system  (IDOCS),  or  a  protected  distribution 
system  (PDS).  (AFMAN  33-214,  Volume  1,  paragraph  5.3.4.). 

2.6.  (U)  Account  for  and  maintain  accountability  of  all  RED  signal  lines.  (AFMAN  33-214,  Volume  I,  paragraph  5.3.5.). 

2.7.  (U)  Separate  RED  signal  lines  from  BLACK  signal  lines  by  a  distance  sufficient  to  easily  distinguish  RED  lines  from 
BLACK  lines.  (AFMAN  33-214,  Volume  1,  paragraph  5.3.6.). 

2.8.  (U)  Mark  all  RED  signal  lines  with  a  1-tnch  wide  strip  of  red  tape  or  red  paint  at  intervals  of  approximately  1  1/2  meters. 
Do  not  mark  RED  signal  lines  less  than  2  meters  long  unless  they  penetrated  a  \^l,  ceiling,  or  floor.  (/VFMAN  33-214,  Volume 
1,  paragraph  5.3.7.). 

(U)  (Continued  in  Bkick  10.  on  page  2  of  3) 


TYKO  on  rtUNTtO 
NAME.  OnOANIZArtON 
FHONE  NUMBEIt.  AND 


A.  an  IF  OFFICE 

B-  fltfUSER 

c.  an  DATE 

MSgt  John  Bodien 

Dwiaht  Bohl.  AFCTTA.  779-5614 

HO  AFCA/GCI.  779-5913 

l-lA<laralL*UI4 


7.  an  TRACXINQ  AND  ADDRESS  MFORMATION. 


A.  an 

TRACKMO  NUMBER:  AFCA-Scott-001 
E-MAIL  ADDRESS:  john.bodieiK^scott.sf.  mil 

MESSAGE  ADDRESS; 


S.  fU!  CTTA  VALIDATION  X  E-MAIL 


S.  iUl  EMISSION  SECURITY  CERTIFICATION 


k.anyn  office 
Dwight  Bohl, 
AFCTTA.  779-5614 


B  an 

MAILING  ADDRESS: 


B.  an  SIGNATURE 


2001  03  01 
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Figure  A22.2.  AF  Form  4170,  Emission  Security  Assessments  (Page  2). 

CONFIDENTIAL  WHEN  FILLED  IN  SAMPLE _ 

10.  M  coimwuATiow:  AFCA-Sco«-001 
(P«ge  2  of  3) 

2.9.  (U)  Senile  Patch  Panels.  Not  needed.  No  patch  panels  installed.  (AFMAN  33-214,  Volume  1.  paragraph  5.3.8.) 

2.10.  (U)  Control  BLACK  Magnetic  Media. 

2.10.1  (U)  Either: 

2.10.1.1.  (U)  Separate  RED  equipment  from  BLACK  tape  players  or  recorders  (e.e.g.  audio  [comfort  music  systems],  video 
[television-video  cassette  recorder  systems),  unclassified  dau  recorders  or  players,  etc.)  by  10  meters.  (AFMAN  33-214, 

Volume  1,  paragraph  S.3.9.1.1.3.) 

2.10.1.2.  (U)  And  separate  any  RED  signal  wire  lines.  RED  power  cords,  and  RED  and  BLACK  signal  ground  wires  2  meters 
from  BLACK  signal  wire  lines  and  BLACK  magnetic  tapes  from  the  facility.  (AFMAN  33-214,  Volume  1,  paragraph  5.3.9.I.2.) 

2.10.2.  (U)  Or,  do  not  remove  BLACK  magnetic  tapes  from  the  huility.  (AFMAN  33-214,  Volume  1,  paragraph  5.3.9. 1.3.) 

2.10.3.  (U)  Or,  degauss  BLACK  magnetic  tapes  before  removing  them  ^m  the  facility.  (AFMAN  33-214,  Volume  1, 
paragraph  5.3.9. 1.4.). 

2.10.4.  (U)  There  are  no  separation  requiremenu  for  compact  disk  players.  (AFMAN  33-214,  Volume  1,  paragraph  5.3. 9.2.) 

2.10.5.  (U)  The  decision  to  allow  tapes  into  the  facility  is  made  by  the  security  manager  for  the  facility.  (AFMAN  33-214, 
Volume  1,  paragraph  5.3.9. 3.) 


3.  (U)  INFORMATION  SYSTEMS  COUNTERMEASURES. 

3.1.  (U)  CRTTERIONS. 

3.1.1.  (U)  The  inspectable  space  is  defmed  as  the  base  perimeter,  minimum  100  meters. 

3.1.2.  (U)  Using  the  Zenith  Z-Station  510,  from  the  generic  zone  assignment  for  computers.  Micro;  the  equipment  is  Zone  C 

3.1.3.  (U)  Facility  Zone  C,  Equipment  2:one  C  countermeasures  were  used.  (AFMAN  33-214,  Volume  2,  AtUchment  14) 

3.2.  (C)  REQUIRED  COUNTERMEASURES  (U). 

3.2.1.  (U)  Mainuin  a  minimum  of  100  meters  of  inspecuble  space.  (AFMAN  33-214,  Volume  2,  paragraph  A14.3.1) 

3.2.2.  (U)  Separate  RED  equipment  0.5  meters  from  BLACK  equipment.  (AFMAN  33-214,Volume  2,  paragraph  A14.3.2) 

3.2.3.  (U)  Separate  RED  equipment  from  BLACK  wire  BLACK  wire  lines  by  1  meter.  Cost:  SO.OO.  (AFMAN  33-214. 
Volume  2,  paragraph  AI4.3.3) 

3.2.4.  (U)  RED  Equipment  and  BLACK  Power  Lme  Separation.  Not  needed.  Power  lines  contained  within  inspectable  space  to 
point  where  the  load  exceeds  100  KVA.  (AFMAN  33-214, Volume  2,  paragraph  A14.3.4) 

3.2.5.  (U)  RED  Wire  Line  and  BLACK  Wire  Line  Separation.  Not  needed.  Cable  length  exceeds  2  kra.  (AFMAN 
33 -2 14, Volume  2.  paragraph  AI4.3.S) 

3.2.6.  (U)  Shielded  RED  Wire  Line.  Not  needed.  No  TEMPEST-certified  equipment  used.  (AFMAN  33-214,  Volume  2, 
paragraph  AI4.3.6) 

3.2.7.  (U)  RED  Power.  Not  needed.  The  length  of  BLACK  wire  BLACK  wire  lines  exceeds  1  km.  (AFMAN  33-214,  Volume 
2,  paragraph  A14.3.7) 

3.2.8.  (U)  Do  not  place  the  telephone  instrument  on  the  same  metal  desktop,  metal  bench  surface,  metal  shelf,  or  metal  cabinet 
top  as  the  RED  equipment.  Cost:  $0.00.  (AFMAN  33-214,  Volume  2,  paragraph  A14.3.8.1) 


4.  (U)  COMMUNICATIONS  SYSTEMS  COUNTERMEASURES. 

4.1.  (U)  CRTTERIONS. 

4.1.1.  (U)  Land  mobile  radio  base  station. 

4.1.2.  (U)  Using  the  Zenith  Z-Station  510,  from  the  generic  zone  assignment  for  computers,  micro;  the  equipment  is  Zone  C. 

4.2.  (C)  REQUIRED  COUNTERMEASURES  (U). 

4.2.1.  (U)  Separate  radio  base  sution  10  meters  from  all  RED  equipment.  (AFMAN  33-214,  Volume  2,  paragraph  3.3.1) 

4.2.2.  (U)  Do  not  power  RED  equipment  and  the  base  station  from  the  same  AC  power  circuit.  (AFMAN  33-214,  Volume  2, 
paragraph  3.3.2) 

4.2.3.  (U)  Signal  and  Control  Lines  Separation.  Not  needed.  Base  station  is  self  contained  with  no  remote  lines.  (AFMAN 
33-214,  Volume  2,  paragraph  3.3.3) 


(U)  (Continued  in  Block  10.  on  page  3  of  3) 
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Figure  A22.3.  AF  Form  4170,  Emission  Security  Assessments  (Page  3). 

CONFIDENTIAL  WHEN  FILLED  IN 


10.  M  CONTINUATION: 

(Page  3  Of  3) 


AFCA-Sco«-CI01 


5.  '(U)  CRYPTOGRAPHIC  EQUIPMENT  COUNTERMEASURES. 

5.1.  (U)  CRITERIONS. 

5.1.1.  (U)  KIV-7. 

5.2.  (U)  REQUIRED  COUNTERMEASURES. 

5.2.1.  (U)  Do  Not  use  computer  internal  modems.  Use  external  modems.  (AFMAN  33-214,  Volume  2.  paragraj*  4.4.2. 1) 

5.2.2.  (U)  Use  the  manufacturer's  supjrfied  cables.  (AFMAN  33-214.  Volume  2,  paragraph  4.4.2. 2) 

5.2.3.  (U)  A  rack  is  not  required  if  the  KlV-7  is  not  installed  in  a  computer.  (AFMAN  33-214,  Volume  2,  paragraph  4.4.2.3) 

5.2.4.  (U)  Use  the  manufacturer's  rack  if  rack  mounted.  (AFMAN  33-214,  Volume  2.  paragrai^  4. 4.2. 3) 

5.2.5.  (U)  Separate  modems  1  meter  from  RED  equipmem.  Do  not  use  an  internal  modem.  (AFMAN  33-214,  Volume  2. 
paragraph  4.4.2.4) 

5.2.6.  (U)  There  arc  no  separation  requirements  between  the  KIV-7  and  RED  or  BLACK  equipment.  (AFMAN  33-214,  Volume 
2,  paragrsqrh  4.4.2.5) 


